Edge Vulnerability CVE-2026-45492: Origin…

A flaw in Microsoft Edge’s cross-device sign-in mechanism, tracked as CVE-2026-45492, allows attackers to bypass Windows Virtualization-Based Security (VBS) without administrative privileges. Microsoft has issued a patch but warns that exploitation is 'more likely.'

Edge Vulnerability CVE-2026-45492: Origin Validation Error Bypasses Windows VBS

On June 4, 2026, Trend Micro’s Zero Day Initiative (ZDI) published advisory ZDI-26-329, detailing a vulnerability in Microsoft Edge’s cross-device managed sign-in mechanism. Discovered by Orange Tsai of the DEVCORE Research Team during Pwn2Own, the flaw was addressed by Microsoft on May 15 with the release of Edge version 148.0.3967.70. Technical details now reveal the bug is an origin validation error that allows attackers to bypass Windows Virtualization-Based Security (VBS) without requiring administrative privileges. Although Microsoft has not observed active exploitation, it classifies the likelihood of an attack as "Exploitation More Likely."

Key Takeaways

Vulnerability CVE-2026-45492 resides in the cross-device managed sign-in mechanism of Microsoft Edge and was demonstrated at Pwn2Own by Orange Tsai (DEVCORE).
A remote attacker who convinces a victim to visit a malicious page or open a malicious file bypasses origin validation to access restricted functionality.
Microsoft confirms the specific impact is a bypass of Windows Virtualization-Based Security (VBS) without administrative privileges, undermining platform security hardening.
The patch is available starting with Edge version 148.0.3967.70 (released May 15, 2026); the base CVSS score is 4.3 per ZDI (CVSS 3.0) and 5.4 per Microsoft (CVSS 3.1).

The Failure Mechanism: When Origin Checks Fail

According to the ZDI advisory, the specific defect is "insufficient validation of the origin of web content" within Edge's cross-device managed sign-in. Under normal conditions, this mechanism verifies that only web content from trusted origins can access reserved browser functionalities. The lack of validation creates a breach, allowing content from untrusted origins to interact with components that require strict provenance guarantees.

ZDI describes the vector as remote but dependent on user interaction: "User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file." The UI:R requirement in the CVSS vector reflects this dependency, indicating the attack is not entirely autonomous. The nature of the web content—whether a page or a file—suggests phishing or the distribution of malicious documents as the primary triggers.

The immediate documented consequence is access to "restricted functionality." ZDI further specifies that an attacker can "leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current user." This technical framing identifies the bug not as a direct RCE, but as a bypass primitive essential for an exploit chain.

Dual Severity Ratings: Why CVSS 4.3 and 5.4 Coexist

The discrepancy in severity scores is not a contradiction but a reflection of different metrics. ZDI assigns a 4.3 score with CVSS 3.0 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating no loss of confidentiality, limited impact on integrity, and no impact on availability. Conversely, Microsoft MSRC reports a 5.4 MEDIUM score using CVSS 3.1, incorporating temporal metrics (E:U/RL:O/RC:C) that raise the score. Both figures are accurate within their respective frameworks; security professionals recognize that the transition from 3.0 to 3.1 calculators often introduces systematic variations.

The shared vector AV:N/AC:L/PR:N/UI:R/S:U confirms a low-complexity network attack that requires no preliminary privileges but does necessitate user interaction. The absence of confidentiality and availability impacts in the ZDI vector indicates that the primary damage is not data exfiltration or denial of service, but rather the manipulation of functionality and the bypassing of security controls.

"An authenticated local attacker can disable or enable Windows VBS without administrative privileges, resulting in bypass of platform security hardening." — Microsoft MSRC, CVE-2026-45492

Undermining Windows VBS: The True Target of the Bypass

The element that elevates this vulnerability beyond its numerical score is the specific impact acknowledged by Microsoft: the bypass of Windows Virtualization-Based Security. VBS isolates critical security processes in a virtualized environment separate from the operating system, making it harder for attackers to exploit kernel privileges or use low-level tampering techniques. MSRC's confirmation that a locally authenticated attacker—a condition made possible by the Edge remote primitive—can "disable or enable Windows VBS without administrative privileges" transforms a browser flaw into an attack on the trust surface of the entire Windows platform.

The dossier does not specify if the VBS bypass is the only operational result or if other undocumented impacts exist. What is verified is the logical chain: from a web page to the enabling/disabling of an architectural security feature, without OS-level escalation but with significant architectural consequences.

Pwn2Own, Disclosure, and the "Exploitation More Likely" Assessment

The timeline is compact: the report reached the vendor on May 20, 2026, the patch was released on May 15, and the coordinated public release occurred on June 4. The seemingly inverted timeline—patching before the report—is explained by the Pwn2Own model, where the conference serves as the deadline for the fix. Orange Tsai, renowned for research into Microsoft and Windows systems, presented the bug within this competitive framework, which was subsequently validated by Trend Micro ZDI.

Microsoft MSRC lists the status as "Exploited: No" but simultaneously notes "Exploitation More Likely." This combination is critical for patching priorities; despite the absence of a known public exploit, the vendor considers it highly probable that threat actors will develop a functional one. The dossier does not indicate whether this assessment stems from similarity to other vulnerabilities, patterns observed in threat intelligence, or other factors. Uncertainty remains regarding which "other vulnerabilities" would be required to complete the RCE chain mentioned by ZDI.

Remediation Steps

Four priority actions follow directly from the documented facts:

Verify Edge Version: Ensure systems are running version 148.0.3967.70 or later, released May 15, 2026, based on Chromium 148.0.7778.168.
Monitor Windows VBS Status: Audit corporate systems, as the source confirms the bypass can alter configurations without admin privileges.
Review Phishing Defenses: Reassess security posture regarding user interaction requirements, as the vector relies on malicious web pages or files rather than autonomous exploits.
Prioritize Rollout: Act on Microsoft’s "Exploitation More Likely" assessment, recognizing that the risk window remains critical for unpatched environments.

Analysis: A Low Score Hiding Architectural Impact

Technical analysis suggests a paradox frequent in vulnerability assessment: the low CVSS score—4.3 or 5.4—fails to capture the depth of the impact. While the Edge bug does not grant immediate system control, it removes a defensive layer that Windows considers fundamental to platform integrity. In enterprise environments where VBS supports Credential Guard or Hypervisor-protected Code Integrity (HVCI), its silent disablement exposes the system to subsequent attacks that would otherwise be mitigated.

The Pwn2Own-ZDI-vendor patch combination also illustrates a functioning chain of trust: competitive discovery, coordinated disclosure, and a fix issued before public release. The residual risk lies not in a lack of information but in the speed of patch deployment. As the default Windows browser, Edge has a massive install base; every unpatched instance retains the VBS bypass primitive.

The dossier does not clarify if alternative mitigations exist or if Microsoft has released specific VBS security updates independent of the Edge patch. The documented evidence is sufficient to establish priority: a browser bug with platform-level impact, rated as likely exploitable, with a fix available for nearly three weeks.

Information has been verified against cited sources and is current as of the time of publication.

Sources

Sources and references