The Circuitry
THE CIRCUITRYYour one-stop source for all tech news
HOMETODAYNEWSFEEDEVENTS
BOOKMARKS
RSS
© 2026 The Circuitry
About UsSourcesContactCorrectionsPrivacy
  • Today
  • Feed
  • Events
  • Saved
Scroll for more
Verification
VERIFIEDConfidence: HIGH
Source identified
Claims cross-referenced
No discrepancies found
Fact-check summary

NVD and Feedly confirm the CVE-2026-57989 origin validation error in Microsoft Edge (CVSS 7.4) affecting versions prior to 150.0.4078.99.

Sourcing
1source

via NVD

NVD · track record
16Stories
100%Verified
1630d
All sources →
Markets
MSFT···

Live quote · not investment advice

Home/Tech/Microsoft Edge Origin Validation Flaw CVE-2026-57989 Rated High Severity
VERIFIEDBy Xavier Rivera· ·1 min read

Microsoft Edge Origin Validation Flaw CVE-2026-57989 Rated High Severity

Microsoft disclosed CVE-2026-57989, a high-severity origin validation error in Chromium-based Edge that lets an unauthorized attacker disclose information over a network. The flaw is rated CVSS 7.4 and affects versions before 150.0.4078.99.

Source:NVD
Post
Microsoft Edge Origin Validation Flaw CVE-2026-57989 Rated High Severity
TL;DRAI · 60 sec read

Microsoft disclosed CVE-2026-57989, a high-severity origin validation flaw in its Chromium-based Edge browser. The vulnerability permits an unauthorized attacker to disclose information over a network with a CVSS 3.1 score of 7.4. It affects versions prior to 150.0.4078.99, requiring users to install the available security update from Microsoft.

Microsoft has disclosed a high-severity origin validation error in its Chromium-based Edge browser that can allow an unauthorized attacker to disclose information over a network.

The vulnerability carries a CVSS 3.1 base score of 7.4. The flaw is tracked as CVE-2026-57989. It affects Microsoft Edge versions prior to 150.0.4078.99.
An unauthorized attacker could exploit the flaw to disclose information.

The issue was published to the CVE List and added to the NVD dataset on July 26, 2026. Microsoft Corporation provided the CVSS vector string AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. This indicates network attack vector, low attack complexity, no privileges required, user interaction required, changed scope, high confidentiality impact, and no integrity or availability impact.
From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →
The weakness is classified as CWE-346 Origin Validation Error. An unauthorized attacker could exploit the flaw to disclose information. The vulnerability was received from Microsoft Corporation on July 26, 2026 at 2:18:25 PM.
This indicates network attack vector, low attack complexity, no privileges required, user interaction required, changed scope, high confidentiality impact, and no integrity or availability impact.
Details appear in Microsoft's security update guide. The reference is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57989. No additional metrics for CVSS 4.0 or 2.0 were provided by NVD at publication.
The affected product is listed as Microsoft Edge (Chromium-based) version 1.0.0.0 less than 150.0.4078.99. Users should update to the fixed version once available from Microsoft.

EXPERT TAKE

Enterprise security teams should prioritize patching Edge to the 150.0.4078.99 release to mitigate the high confidentiality risk from this network-reachable flaw.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported
DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE
From The Circuitry

See what’s happening right now

The Feed runs all day — short, verified briefs the moment they break.

Open the Feed →
From The Circuitry

Follow @thecircuitry_

Every story we publish, as it happens. No noise between.

Follow on X ↗On Bluesky ↗

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee
MicrosoftEdgeVulnerabilitySecurity
More fromNVD
  • Zyxel WAX650S Firmware Hit by High-Severity Command Injection Flaw

    Tech · 4d
  • Microsoft Office Excel Use-After-Free Flaw Rated CVSS 8.8

    Tech · 4d
  • NVD Adds Shell Injection Flaw in Wazuh GitHub Actions Workflows as CVE-2026-67308

    Tech · 7d
More inTech
  • Tesla and SpaceX confirm Terafab chip fab in Texas

    Tech · 1d
  • OpenAI Urges Federal Judge to Throw Out Apple's Trade Secrets Complaint

    Tech · 2d
  • Meta introduces Muse Code, its terminal-based coding agent

    Tech · 2d
SupportThe Work

The Circuitry is reader-supported. If you find the daily brief useful, you can buy me a coffee to keep it going.

Buy a coffee →
SubscribeCircuitry Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Free forever.

MORE IN TECH

Tesla and SpaceX confirm Terafab chip fab in Texas

Tesla and SpaceX have confirmed Grimes County, Texas as the site for their Terafab semiconductor megafactory, with the first phase costing roughly $16.8 billion. The project targets the largest chip manufacturing facility on the planet to supply over 1 terawatt of compute per year that exceeds current and future global production capacity.

OpenAI Urges Federal Judge to Throw Out Apple's Trade Secrets Complaint

OpenAI has filed a motion asking a federal judge to dismiss Apple's trade secrets lawsuit, describing the claims as meritless. The dispute, which follows a July suit and this week's injunction request from Apple, highlights tensions after their prior partnership on Siri and OpenAI's hardware push.

Meta introduces Muse Code, its terminal-based coding agent

Meta has released an early beta of Muse Code, a terminal-based coding agent driven by the updated Muse Spark 1.2 model and positioned against Anthropic's Claude Code and OpenAI's Codex. Substantially lower rates, including a contributor plan at $0.10 for every million tokens received, may encourage migration away from higher-priced options such as Anthropic's Sonnet 5.