Product:
Microsoft Edge
Summary
External control of file name or path in Microsoft Edge allows an unauthorized attacker to disclose information over a network. This vulnerability can lead to significant confidentiality impacts, making sensitive information accessible to attackers. The issue arises from improper handling of file names or paths, which can be exploited under certain conditions.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.4 | CVE-2026-41107 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious link that, when clicked by a user, triggers the disclosure of sensitive information. The attack requires user interaction, as the victim must open the link in Microsoft Edge. Once the link is activated, the attacker can gain access to confidential data transmitted over the network.
Affected Products
- Microsoft Edge: A web browser that is vulnerable to external control of file names or paths, allowing unauthorized information disclosure.
Mitigation
To mitigate this vulnerability, users should ensure they are using the latest version of Microsoft Edge, as updates may contain patches that address this issue. Additionally, users should exercise caution when clicking on links from untrusted sources to minimize the risk of exploitation.