Edge Tab-Splitting and Invisible Phishing: The…

CVE-2026-45494: A Universal XSS in Microsoft Edge discovered by Orange Tsai leverages tab-splitting to mask malicious URLs. Update to version 148.0.3967.70 is required.

Edge Tab-Splitting and Invisible Phishing: The Pwn2Own Flaw

Orange Tsai of the DEVCORE Research Team demonstrated a Universal Cross-Site Scripting (UXSS) vulnerability in Microsoft Edge during Pwn2Own on May 20, 2026. Tracked as CVE-2026-45494 and ZDI-26-330, the flaw goes beyond simple script injection; it hooks into the browser’s "tab-splitting" productivity feature. This feature truncates the displayed URL, making the attack vector visually indistinguishable from legitimate navigation. While Microsoft patched the bug in version 148.0.3967.70 on May 15, the intersection of technical vulnerability and visual social engineering raises broader questions about modern UI design.

Key Takeaways

CVE-2026-45494 is a Universal XSS in Microsoft Edge discovered by Orange Tsai (DEVCORE) during Pwn2Own 2026, with coordinated disclosure published on June 4.
The flaw resides in Edge's navigation handling, which fails to properly validate user-supplied data, allowing cross-origin script injection into a target domain.
The attack mechanism leverages Edge's tab-splitting feature, which displays only the domain prefix instead of the full URL, facilitating visual phishing.
Microsoft has classified exploitability as "Exploitation More Likely" and released the fix in build 148.0.3967.70 (Chromium 148.0.7778.168) on May 15, 2026.

The Attack Chain: From Hidden Frames to Domain Impersonation

The vulnerability triggers when a user visits a webpage containing a malicious iframe. According to advisory ZDI-26-330, "the specific flaw exists within the handling of navigation. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to execute code in the context of a target domain."

The cross-origin vector is critical: the attacker does not aim to compromise their own domain but forces code execution within a chosen third-party site. This enables session hijacking, authenticated cookie theft, and UI manipulation within banking platforms, webmail, or corporate services.

The attack requires explicit human interaction. The ZDI advisory specifies that "the user must visit a malicious page or open a malicious file." This is not a completely invisible drive-by exploit, but rather one that relies on the perceived credibility of the initial page.

Tab-Splitting as a Visual Risk Multiplier

This is where Edge’s design components come into play. The Microsoft Security Response Center (MSRC) documented that "the browser's tab-splitting feature, which allows users to browse two tabs simultaneously, shows only the domain prefix in the address bars instead of the full URL. This behavior can lead to phishing vulnerabilities, as attackers could exploit it to make malicious websites appear legitimate by mimicking trusted domain names."

The distinction between a full URL and a domain prefix is more than an aesthetic detail. Under normal conditions, a user checking the address bar might spot suspicious subdomains or anomalous parameters. With tab-splitting active, that line of defense shrinks to a few characters. If an attacker registers a domain that visually mimics the target, manual verification becomes technically impossible within the truncated interface.

Microsoft does not specify whether version 148.0.3967.70 modifies tab-splitting behavior or exclusively fixes the navigation handling component.

Severity Assessment and Source Discrepancies

Official CVE records assign CVE-2026-45494 a CVSS 3.1 score of 5.4 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. In contrast, advisory ZDI-26-330 reports a CVSS 5.0 with the vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L. This discrepancy is consistent with the use of different calculator versions: ZDI indicates a higher Attack Complexity (AC:H vs. AC:L) and adds an impact on availability (A:L) absent from the CVE 3.1 score.

Both systems agree on the core factors: unprivileged network access (AV:N), no prior privileges required (PR:N), and mandatory user interaction (UI:R). While the formal severity is not extreme, the combination with the tab-splitting visual vector elevates operational risk beyond the numerical score.

The CVE record confirms the CWE-79 classification (Improper Neutralization of Input During Web Page Generation). There is currently no evidence of in-the-wild exploitation; Microsoft lists the status as "Exploited: No."

"The user would have to open a web page that contains a malicious iframe." — Microsoft MSRC, responding to 'What interaction would the user have to do?'

Mitigation and Next Steps

Update Microsoft Edge to version 148.0.3967.70 or later, released May 15, 2026, with Chromium 148.0.7778.168, which addresses the vulnerability according to the Microsoft Security Response Center.
Audit corporate policies to determine if tab-splitting is enabled by default and consider disabling it until UI fix clarifications are provided, as Microsoft has not specified if the fix includes changes to truncated URL display logic.
Review web filtering controls to detect cross-origin iframes from unclassified domains, as the attack requires opening a page containing a malicious iframe.
Integrate CVE-2026-45494 into vulnerability management systems, distinguishing the 5.4 CVSS score in the official record from the 5.0 score in the ZDI advisory for reporting consistency.

When UX Design Becomes an Attack Surface

CVE-2026-45494 is a rare case where the technical vulnerability and its visual amplifier are both products of the same vendor. Tab-splitting is not a third-party component or a legacy configuration; it is a promoted productivity feature. This raises structural questions about the threat modeling processes preceding UI feature releases, particularly those that alter how users verify web resource authenticity.

For the enterprise sector, the lesson is twofold. First, a "Medium" CVSS score must not lead to low patching priority; the visual phishing vector can far outweigh the theoretical impact of the score. Second, tab-splitting introduces a user behavior variable that traditional security awareness training does not cover: how do you train users to recognize a URL when the interface deliberately hides most of it?

Orange Tsai and the DEVCORE Research Team demonstrated the bug at Pwn2Own, a competition that rewards practical exploitability. Presenting this attack chain in that context confirms that the research community views the XSS + tab-splitting combination as a concrete risk. The coordinated disclosure on June 4, 2026, released the technical details; the gap between the fix (May 15) and the advisory (June 4) provides a documented exposure window that organizations should cross-reference with their own patching timelines.

Frequently Asked Questions

Is tab-splitting the only element required for the attack?

No. Tab-splitting acts as a visual credibility multiplier, but the technical vulnerability requires the user to open a page containing a malicious iframe that exploits Edge's improper navigation handling. Without the XSS component, URL truncation alone does not allow cross-origin script execution.

Why do CVSS scores differ between ZDI and the CVE Record?

Advisory ZDI-26-330 uses a calculator that assigns Attack Complexity: High (AC:H) and an impact on availability (A:L), resulting in a 5.0. The official CVE Record applies CVSS 3.1 with AC:L and no availability impact (A:N), totaling 5.4. Both fall within the Medium range; the variation reflects different interpretations of the same attack vector.

Is it known if Microsoft's fix modifies tab-splitting behavior?

The documentation does not clarify this point. The Microsoft Security Response Center identifies version 148.0.3967.70 as the fix but does not specify if it addresses only the vulnerable navigation component or also the URL display logic within tab-splitting.

Sources

Sources and references