CVE-2026-88097: 
Schwachstellenanalyse und -minderung

CVE-2026-88097 is a use-after-free (UAF) vulnerability in Microsoft Edge (Chromium-based) that allows an unauthenticated local attacker to elevate privileges on the affected system. The vulnerability was disclosed on September 18, 2026, and affects all versions of Microsoft Edge (Chromium-based) prior to 153.0.4234.46. It carries a CVSS v3.1 base score of 8.1 (High) (MSRC Advisory, GitHub Advisory).

The vulnerability is classified as CWE-416 (Use After Free), occurring when Microsoft Edge reuses or references memory after it has been freed, potentially allowing an attacker to manipulate the freed memory region to gain elevated privileges. The attack vector is local, requires no privileges and no user interaction, but has high attack complexity, suggesting exploitation requires specific timing or race conditions to trigger the memory corruption reliably. The changed scope indicates that a successful exploit can impact resources beyond the security boundary of the vulnerable Edge component itself (MSRC Advisory, GitHub Advisory).

Successful exploitation of CVE-2026-88097 allows an unauthenticated local attacker to elevate their privileges on the affected system, with high impact to confidentiality, integrity, and availability. The changed scope means the exploit can affect components or resources outside the Edge browser's immediate security boundary, potentially enabling an attacker to access sensitive data, modify system resources, or disrupt availability of affected services (MSRC Advisory, GitHub Advisory).

As of the disclosure date (September 18, 2026), there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. A vendor patch is available from Microsoft (MSRC Advisory).

Microsoft has released a patch addressing this vulnerability; users should update Microsoft Edge (Chromium-based) to version 153.0.4234.46 or later. Edge typically updates automatically, but administrators should verify deployment across managed endpoints. No configuration-based workarounds have been published; upgrading to the patched version is the recommended and only confirmed remediation (MSRC Advisory, GitHub Advisory).

The vulnerability received standard coverage across vulnerability tracking platforms including VulDB, CVEFeed, and ENISA's EUVD shortly after disclosure. Social media mentions were observed on Mastodon and Bluesky, primarily from automated CVE notification accounts. No notable independent researcher commentary or significant media coverage has been identified beyond routine vulnerability aggregation (MSRC Advisory).