CVE-2026-66326 is a medium severity (CVSS 6.5) missing authorization flaw in Microsoft Edge (Chromium-based). Microsoft lists version 151.0.4129.59 as fixed. Its FAQ ties the attack to a user visiting a malicious page and using two tap gestures that activate autofill. Update Edge to that version or later.
What's affected
The record describes missing authorization (CWE-862) in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code over a network. Microsoft's update guide lists the fix as 151.0.4129.59, released on 31 July 2026 on Chromium 151.0.7922.71 or .72.
Microsoft's scoring is 6.5 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. It matches the record. As with the sibling entry CVE-2026-66312, the entry is titled remote code execution while the vector rates integrity impact only. Read both and patch.
Microsoft's FAQ says the attack requires a client to connect to a malicious server, which could give the attacker code execution on the client. It also says the user must visit an attacker controlled webpage and perform two tap gestures that cause autofill to activate. That is a lot of conditions, which is a reason the score is moderate.
How to check if you're exposed
Go to edge://settings/help in Edge and read the version. Anything below 151.0.4129.59 is behind the fix. The wording about tap gestures suggests touch devices are the main case, so look at phones, tablets and touch laptops first. Microsoft's guide does not give a list of affected device types, so apply the fix everywhere.
Report versions from your endpoint management tool for devices you do not touch directly.
What to do now
- Read the Edge version on every managed device.
- Update to 151.0.4129.59 or later and restart the browser.
- Review your update policy for deferrals.
- Remind users not to use autofill on pages they do not trust.
- Check the update guide entry for any revision.
Why it matters
Missing authorization means a check that decides whether an action is allowed is absent. In a browser, that can let content from one source trigger behavior that should require permission. Here Microsoft links the behavior to autofill, a feature that fills in saved personal data when a user interacts with a page.
The need for user interaction lowers the risk. Still, tricking someone into a few taps on a web page is not hard to arrange, and that is why browser fixes are best applied on a schedule that does not rely on users.
Microsoft marks it as not publicly disclosed and not exploited at release, with exploitation unlikely. The record's KEV flag is false.
Quick check
Does the user have to do anything?
Yes. Microsoft says the user must visit an attacker controlled page and perform two tap gestures that activate autofill.
Is this the same bug as CVE-2026-66312?
No. They are separate entries with different weakness classes, fixed in the same Edge build.
Sources
- Microsoft Security Response Center update guide entry for CVE-2026-66326
- NVD record for CVE-2026-66326
Last reviewed: 18 October 2026.
