CVE-2026-41107
High
Published: 12 May 2026
Published
12 May 2026
Modified
15 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1
7.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
EPSS Score
0.0016
36.3th percentile
Risk Priority
15
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2026-41107 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Microsoft Edge Chromium. Its CVSS base score is 7.4 (High).
Operationally, ranked at the 36.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-29690
Vulnerability details
External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Insufficient information to map techniques.Confidence: LOW · MITRE ATT&CK Enterprise v18.1
CVEs Like This One
CVE-2025-21408Same product: Microsoft Edge Chromium
CVE-2025-21279Same product: Microsoft Edge Chromium
CVE-2026-21223Same product: Microsoft Edge Chromium
CVE-2026-45495Same product: Microsoft Edge Chromium
CVE-2025-21342Same product: Microsoft Edge Chromium
CVE-2025-21283Same product: Microsoft Edge Chromium
CVE-2025-24054Same vendor: Microsoft
CVE-2025-59291Same vendor: Microsoft
CVE-2026-41088Same vendor: Microsoft
CVE-2026-20931Same vendor: Microsoft
Affected Assets
microsoft
edge chromium
≤ 148.0.3967.55
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.