CVE-2026-0102CWE-359
Microsoft Edge (Chromium-based) Defense in Depth Vulnerability
Low · published February 17, 2026
What it is
Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consent. This could result in disclosure of stored autofill data such as addresses, email, or phone number metadata.
The record
Technical detail
- CVSS v3.1
- 3.1 · LOW
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C
- CVSS v4.0
- Not supplied
- EPSS
- 0.00535 · 44.3th percentile
- Weakness
- CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor
- Published
- 2026-02-17T19:14Z
EPSS history
Timeline