CVE-2026-21223

Improper privilege management in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21223	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-01-16 22:16

Updated : 2026-02-22 17:16

NVD link : CVE-2026-21223

Mitre link : CVE-2026-21223

CVE.ORG link : CVE-2026-21223

JSON object : View

Products Affected

microsoft

edge_chromium

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2026-21223", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "secure@microsoft.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.5}]}, "published": "2026-01-16T22:16:25.983", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21223", "tags": ["Vendor Advisory"], "source": "secure@microsoft.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secure@microsoft.com", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "Improper privilege management in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally."}, {"lang": "es", "value": "El Servicio de Elevaci\u00f3n de Microsoft Edge expone una interfaz COM privilegiada que valida de forma inadecuada los privilegios del proceso llamador. Un usuario local est\u00e1ndar (no administrador) puede invocar el m\u00e9todo de interfaz IElevatorEdge LaunchUpdateCmdElevatedAndWait, haciendo que el servicio ejecute comandos de actualizaci\u00f3n privilegiados como LocalSystem.\nEsto permite a un no administrador habilitar o deshabilitar la Seguridad Basada en Virtualizaci\u00f3n (VBS) de Windows modificando claves de registro de sistema protegidas bajo HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard. Deshabilitar VBS debilita protecciones cr\u00edticas de la plataforma como Credential Guard, la Integridad de C\u00f3digo Protegida por Hipervisor (HVCI) y el kernel seguro, lo que resulta en una omisi\u00f3n de caracter\u00edstica de seguridad."}], "lastModified": "2026-02-22T17:16:54.310", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "004B4A9D-AEC7-40B6-9C4D-A249AF5EB048", "versionEndExcluding": "144.0.3719.82"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}