CVE-2026-45495 is a remote code execution vulnerability in Chromium-based Microsoft Edge, scored CVSS 8.8 (high). It needs a user to open crafted content. Update Edge to the current stable build and check the Microsoft Security Update Guide for the exact fixed version.
What's affected
The record names Microsoft Edge (Chromium-based) and gives no version range. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
When I fetched the Microsoft Security Update Guide page, it returned only a generic shell with no version or details. I will not state a fixed build. Open the page in a browser to read it.
How to check if you're exposed
- Open edge://settings/help. Edge shows its version and checks for updates.
- Compare that version with the fixed build in the Microsoft guide for this CVE.
- For managed fleets, use your device management tool to report Edge versions.
What to do now
- Update Edge and restart the browser.
- Confirm the version on a sample of machines.
- Check that update policies are not holding Edge back.
- Remind users to restart when Edge asks.
Why it matters
The record lists CWE-119, CWE-20, CWE-35 and CWE-94. Browser flaws of this type are reached by visiting a page, so patch speed matters. The KEV flag is false and I found no statement of exploitation.
Quick check
Do I need to do more than update Edge?
The record describes no extra steps. Check the Microsoft guide for any additional guidance.
Sources
Last reviewed: 19 October 2026.
