TL;DR: Microsoft Edge (Chromium-based) Remote Code Execution, classified as CWE-35 (Path Traversal) and CWE-20 (Improper Input Validation). Vendor (Microsoft MSRC): 8.8 HIGH. NVD: 9.8 CRITICAL. The NVD score reflects worst-case network attack assumptions; the vendor score reflects observed exploitation complexity. Patch on the higher score, hunt on the worst-case vector.
What This Vulnerability Is
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability.
The National Vulnerability Database assigned this issue a CVSS base score of 9.8, placing it in the CRITICAL category. The identifier CVE-2026-45495 was published on 18 May 2026. The weakness class is CWE-35 (Path Traversal) and CWE-20 (Improper Input Validation).
- CVE Identifier
- CVE-2026-45495
- CVSS Base Score
- 9.8 / 10.0 (CRITICAL)
- CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness Class
- CWE-35 (Path Traversal) and CWE-20 (Improper Input Validation)
- Published
- 18 May 2026
- Vendor Advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45495
- NVD Entry
- https://nvd.nist.gov/vuln/detail/CVE-2026-45495
How a Sherlock Forensic Examiner Triages a Suspected Edge Compromise
If you suspect this vulnerability has been exploited on a user workstation, the first artifact a Sherlock forensic examiner pulls is the Edge crash record. Open Windows Reliability Monitor or query the Application event log for Faulting application name: msedge.exe entries. A single crash is unremarkable. A crash that aligns with a specific browsing session, a specific URL pulled from the Edge History database and an outbound network connection from msedge.exe to a non-CDN destination is the exploitation signature.
The second artifact is the Edge History database. Edge stores browsing history in a SQLite database at %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History. Preserve the file with a SHA-256 hash before opening it. Pull the navigation timeline around the crash window. Look for URLs that match no legitimate corporate browsing pattern, particularly URLs containing unusual path traversal characters or query parameters with binary-looking content. Cross-reference against the cache at %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache to confirm the page actually loaded.
The third artifact is the process tree. The Chromium remote code execution path typically establishes attacker control inside the Edge sandboxed renderer process, then attempts to escape the sandbox into the broker process. If the sandbox escape succeeded, you will see anomalous child processes spawned from msedge.exe in Sysmon Event ID 1 logs. The child process command line is the key tell: legitimate Edge children are other Edge processes or Edge update binaries. Anything else, particularly cmd.exe, powershell.exe, certutil.exe or any executable not signed by Microsoft, is the post-exploitation pivot.
The fourth artifact is persistence. An attacker who achieved code execution through CVE-2026-45495 will attempt to survive a browser restart or a system reboot. Pull the Run key registry hives (HKCU\Software\Microsoft\Windows\CurrentVersion\Run, the corresponding HKLM key, scheduled tasks under \Microsoft\Windows\ custom paths and WMI event subscriptions) with a forensic timestamp. Diff against the workstation imaging baseline. Net-new persistence created within the 24 hours preceding the Edge crash is high-confidence indicator of compromise.
Detection Signature
Illustrative Sigma rule for SIEM-based detection. Tune thresholds to your baseline before production deployment.
title: Suspicious Process Spawned from Microsoft Edge CVE-2026-45495
id: cve-2026-45495-edge-child-process
status: experimental
description: Detects post-exploitation child processes spawned from msedge.exe parent consistent with CVE-2026-45495 sandbox escape.
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: '\msedge.exe'
filter_legitimate:
Image|endswith:
- '\msedge.exe'
- '\MicrosoftEdgeUpdate.exe'
condition: selection and not filter_legitimate
level: high
What to Do About It
- Apply the vendor patch. Follow the vendor advisory for the current patched version. Patch on the NVD-9.8 worst-case scoring rather than the vendor-reduced scoring; the NVD score reflects the worst-case attacker scenario, which is what your incident response plan should be built around.
- Run the forensic triage above on any system showing the indicator pattern. The forensic angle in this analysis is grounded in primary-source NVD data and Sherlock incident response methodology. If your team lacks the bandwidth, an external incident response engagement closes the gap.
- Subscribe to the CISA Known Exploited Vulnerabilities catalog. The CISA KEV catalog tracks CVEs with confirmed in-the-wild exploitation. Treat additions to the KEV catalog as emergency patch tickets.
- Document your response. Record what you checked, what you patched and what residual risk remains. This matters for compliance and for any incident response activity that follows.