CVE-2026-57989: Microsoft Edge Origin Validation Error Allows Remote Information Disclosure

Summary

Microsoft has disclosed CVE-2026-57989, a high-severity vulnerability in Microsoft Edge (Chromium-based) rooted in an origin validation error (CWE-346). The flaw allows an unauthenticated remote attacker to disclose sensitive information across origin boundaries without requiring local access or elevated privileges.

Technical Details

CVE-2026-57989 stems from Edge's failure to properly verify the origin of data or communication requests within its Chromium engine. The Same-Origin Policy (SOP) is the foundational browser security control that prevents web pages from one origin from reading data from another — a breakdown here is significant.

In an origin validation error of this class, a malicious web page can craft requests that Edge incorrectly treats as originating from a trusted source. The browser then allows cross-origin access to resources it should protect: session tokens, authenticated API responses, page content loaded from other origins, or Edge-specific integration data (such as identity features or managed sign-in state).

Unlike upstream Chromium CVEs issued by Google, this CVE was assigned directly by Microsoft, indicating it is specific to Edge's own implementation or its unique integrations — not a general Chrome/Chromium issue.

Attack scenario: A victim visits an attacker-controlled web page. The page exploits the origin validation error to read sensitive data from another origin that the victim is currently authenticated to (e.g., a corporate intranet, a webmail session, or an enterprise application). The stolen data is silently exfiltrated to the attacker's server without the victim's knowledge.

No authentication is required by the attacker; the victim only needs to browse to the malicious page while logged into a target application in another tab or prior session.

Affected Products

• Microsoft Edge (Chromium-based) — all stable, beta, and extended stable channel versions prior to the patched build
• Platforms: Windows, macOS, Linux (all platforms Edge is distributed on)
• This CVE does not affect legacy Microsoft Edge (EdgeHTML-based, discontinued)

Patch and Remediation

Microsoft shipped a fix for CVE-2026-57989 as part of the late-July 2026 Edge out-of-band security update cycle (published 2026-07-26).

Update Microsoft Edge now:

1. Open Edge and navigate to edge://settings/help
2. Edge will check for updates automatically and prompt installation
3. Restart the browser to apply the update
4. Verify the installed version is 150.0.4078.99 or later

Enterprise administrators can enforce Edge updates via:

• Microsoft Intune: Deploy Edge updates through the Microsoft Edge management policies
• Group Policy: Use EdgeUpdate policies to enforce auto-updates
• Microsoft Update / WSUS: Ensure Edge updates are included in your patch management pipeline

Risk Context

A CVSS score of 7.4 places this firmly in the HIGH tier. The key risk factors:

• No authentication required by the attacker — anyone who can serve a web page to the victim is in scope
• Network attack vector — fully remotely exploitable
• User interaction required — the victim must browse to the malicious page, which mitigates automated exploitation but is easily accomplished via phishing

The July 2026 Edge release cycle also addressed multiple Critical-rated Remote Code Execution vulnerabilities (CVE-2026-57988, CVE-2026-58276, CVE-2026-58284, CVSS 8.8–9.8). Organizations should treat this patch cycle as high-priority and update Edge across all managed devices promptly.

Recommended Actions

1. Update Edge immediately to version 150.0.4078.99 or later on all devices
2. Enterprise: Push mandatory Edge updates via Intune or Group Policy — do not wait for user self-service updates
3. Review browser isolation policies: Ensure sensitive internal applications are accessed from browsers with strict origin policies enforced
4. User awareness: Remind users to be cautious of unsolicited links, particularly while logged into sensitive applications

References

• Microsoft Security Response Center — CVE-2026-57989
• NVD — CVE-2026-57989
• Microsoft Edge Release Notes for Security Updates
• Canadian Centre for Cyber Security — Microsoft Edge Security Advisory AV26-714
• CWE-346: Origin Validation Error — MITRE