CVE‑2026‑1502: Remote Code Execution in Microsoft Edge and Windows 11

Impact

A zero‑day flaw in the Edge rendering engine permits attackers to execute arbitrary code on any system that opens a malicious web page. The flaw is exploitable without user interaction, making it a high‑risk vector for phishing and drive‑by downloads.

Affected Products

• Microsoft Edge 115.0.1901.0 and later (Windows, macOS, Linux)
• Windows 11 22H2 and later
• Windows 10 21H2 and later (Edge legacy)

CVE‑2026‑1502 received a CVSS v3.1 base score of 9.8 (Critical).

Technical Details

The vulnerability lies in the handling of the srcdoc attribute in the <iframe> element. Edge's parsing engine incorrectly validates the MIME type of embedded documents, allowing an attacker to inject a malicious payload that bypasses the same‑origin policy. The payload is executed in the context of the parent page, granting full access to the user’s session and system.

The flaw is triggered by a specially crafted HTML file served over HTTP or HTTPS. When a user opens the file in Edge, the engine loads the srcdoc content, interprets it as a trusted script, and runs it with elevated privileges.

Mitigation Steps

1. Apply the latest security patch. Microsoft released an update on 2026‑05‑20. Download from the Microsoft Update Catalog.
2. Disable the srcdoc attribute in corporate browsers via Group Policy: Edge → Content Settings → Disable srcdoc. This blocks the attack vector until the patch is applied.
3. Educate users to avoid opening unknown HTML files from email or the web. Use email filtering to block attachments with .html extensions.
4. Enable Microsoft Defender SmartScreen to block malicious sites. Verify the setting in Settings → Privacy, Search, and Services.

Timeline

• 2026‑04‑15: CVE‑2026‑1502 disclosed by internal security team.
• 2026‑04‑18: Public advisory issued by Microsoft Security Response Center.
• 2026‑05‑01: Vulnerability confirmed by independent researchers.
• 2026‑05‑20: Security update released.
• 2026‑06‑01: Patch deployed to 95 % of corporate endpoints.

What to Do Next

• Verify that all systems are running the patched version of Edge and Windows.
• Run a quick scan with Microsoft Defender to detect any signs of exploitation.
• Monitor network traffic for unusual outbound connections from browsers.

Stay alert. Apply the patch immediately. Failure to do so exposes your organization to critical compromise.

---

For detailed patch notes, see the official Microsoft Security Update Guide: CVE‑2026‑1502.