{"id":"CVE-2026-0102","state":"PUBLISHED","title":"Microsoft Edge (Chromium-based) Defense in Depth Vulnerability","description":"Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consent. This could result in disclosure of stored autofill data such as addresses, email, or phone number metadata.","publishedAt":"2026-02-17T19:14:32.901Z","updatedAt":"2026-08-19T16:25:59.724Z","severity":{"score":3.1,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft Microsoft Edge (Chromium-based)"],"affected":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","status":"affected","lessThan":"145.0.3800.58","versionType":"custom"}]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-0102"],"weaknesses":["CWE-359"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/0xxx/CVE-2026-0102.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-0102","state":"PUBLISHED","datePublished":"2026-02-17T19:14:32.901Z","dateUpdated":"2026-08-19T16:25:59.724Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2025-10-17T23:35:05.037Z"},"containers":{"cna":{"title":"Microsoft Edge (Chromium-based) Defense in Depth Vulnerability","descriptions":[{"lang":"en-US","value":"Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consent. This could result in disclosure of stored autofill data such as addresses, email, or phone number metadata."}],"affected":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","status":"affected","lessThan":"145.0.3800.58","versionType":"custom"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-0102","name":"Microsoft Edge (Chromium-based) Defense in Depth Vulnerability","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"LOW","baseScore":3.1,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-359","description":"CWE-359: Exposure of Private Personal Information to an Unauthorized Actor","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2026-08-19T16:25:59.724Z"},"datePublic":"2026-02-17T16:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0.0","versionEndExcluding":"145.0.3800.58"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-21T21:13:58.897946Z","id":"CVE-2026-0102","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-06T18:56:52.592Z"}}]}}}