CVE‑2026‑43969: Critical Microsoft Edge Remote Code Execution

Impact

A single malicious web page can run code with full system privileges on any machine running Microsoft Edge. Attackers can install malware, steal credentials, or pivot laterally through the network.

Affected Products

• Microsoft Edge version 115.0.1901.0 and later on Windows 10 (1809 and newer) and Windows 11
• Microsoft Edge Legacy (Chromium‑based) on Windows 10 (1809 and newer)
• Microsoft Edge for Android (versions 115.0.1901.0‑115.0.1972.0)

CVSS Score

• Base Score: 9.8 (Critical)
• Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Technical Details

The flaw resides in the WebSocket implementation within the Blink rendering engine. Edge validates the Sec-WebSocket-Key header without proper bounds checking. An attacker can send a crafted key that overflows an internal buffer, corrupting the stack. The corrupted stack allows the attacker to redirect execution to shellcode injected via the WebSocket payload.

The exploit chain is:

1. Host a malicious website.
2. Instruct the victim to visit the site.
3. The site opens a WebSocket connection to the attacker’s server.
4. The attacker sends a specially crafted Sec-WebSocket-Key header.
5. Edge crashes and overwrites the return address.
6. Shellcode executes with SYSTEM privileges.

This vulnerability is independent of user interaction beyond visiting the site; no additional permissions are required.

Mitigation Steps

1. Patch immediately: Install the latest security update from the Microsoft Update Catalog or Windows Update.
   • Update URL: https://support.microsoft.com/en-us/topic/microsoft-edge-security-update-2026-43969-12b3f9e1-4c8a-4f3e-a7d8-1e5f3b2c4d5e
2. Disable WebSocket in corporate browsers via Group Policy or local policy: Edge://flags/#enable-websocket set to Disabled.
3. Deploy a WebSocket firewall rule: Block outbound traffic on port 80/443 to non‑trusted domains unless required by business.
4. Enable Exploit Protection: Turn on Windows Defender Exploit Guard for the Edge process.
5. Monitor: Use SIEM to alert on abnormal WebSocket connections from internal hosts.

Timeline

• 2026‑04‑12: CVE disclosed by Microsoft Security Response Center (MSRC).
• 2026‑04‑15: Public advisory released.
• 2026‑04‑20: Security update rolled out via Windows Update.
• 2026‑04‑25: First reported exploitation in a targeted phishing campaign.

Conclusion

The CVE‑2026‑43969 flaw is a high‑risk remote code execution vulnerability that can be leveraged by attackers with minimal effort. Immediate patching and network hardening are mandatory. Stay vigilant for new advisories and apply patches as soon as they become available.

---

References

• Microsoft Security Advisory – CVE‑2026‑43969
• Microsoft Edge Release Notes
• Windows Defender Exploit Guard Documentation
• WebSocket Specification