Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Microsoft Edge AI agent hijack flaw (CVE-2026-55945)

Vulnerability
First reported
Last updated
Happening score
H score 25
1 unique sources, 1 articles

Summary

Hide ▲

Microsoft Edge has a CVE-2026-55945 flaw that let a browser extension influence the Edge AI agent by combining trusted-page control with a race condition during the think/act transition. Microsoft fixed the issue in Edge 150.0.4078.48 on July 2, 2026. The finding was rated 4.2 and was demonstrated as a proof of concept, with no public evidence of in-the-wild abuse.

Related Happenings

OpenAI ChatGPT Atlas BioShocking fix

Advisory/Mitigation
H score34 First: 01.07.2026 00:50 Last: 01.07.2026 00:50 Sources 1

About this happening: OpenAI delivered a working fix for BioShocking in ChatGPT Atlas, closing a prompt-injection path that could push an AI browser toward unsafe real-world actions and c...

Open Happening

AI chatbot cryptojacking campaign targeting high-performance GPU users

Campaign
H score51 First: 27.05.2026 10:45 Last: 27.05.2026 10:45 Sources 1

About this happening: Microsoft warned of an active cryptojacking campaign that uses SEO poisoning and, in some cases, AI chatbot recommendations to steer users to malicious ZIP downloa...

Open Happening

Microsoft Edge stops loading saved passwords into cleartext memory at startup

Security Tool/Service
H score10 First: 15.05.2026 17:49 Last: 15.05.2026 17:49 Sources 1

About this happening: Microsoft Edge is changing its built-in password manager so saved passwords are no longer loaded into process memory in clear text at startup, reducing the risk of loc...

Open Happening

Pwn2Own Berlin 2026 multi-product zero-days privilege-escalation flaw

Vulnerability
H score40 First: 14.05.2026 21:53 Last: 14.05.2026 21:53 Sources 1

About this happening: Pwn2Own Berlin 2026 opened with 24 unique zero-days demonstrated against fully patched products, creating immediate exposure across browser, OS, virtualization, enterp...

Open Happening

Microsoft MDASH enters limited private preview for AI-driven vulnerability discovery at scale

Security Tool/Service
H score26 First: 13.05.2026 16:46 Last: 13.05.2026 16:46 Sources 1

About this happening: Microsoft's MDASH has entered limited private preview, adding a new AI-driven vulnerability discovery service that can validate and prove exploitable defects at scale....

Open Happening

Timeline

  1. 16.09.2026 17:36 1 articles · 3h ago

    Microsoft fixes Edge AI agent hijack flaw in version 150.0.4078.48

    Mitigation Patch Update

    Microsoft fixed CVE-2026-55945 in Edge version 150.0.4078.48 on July 2, closing a flaw that let an installed browser extension seize a trusted page and, with a race condition between the agent's "think" and "act" modes, steer Microsoft Edge's built-in AI agent.

    Show sources
    Open in new tab
  2. 16.09.2026 17:36 2 articles · 3h ago

    Researchers show a browser extension can steer Microsoft Edge's AI agent

    Initial Disclosure

    Forever Security showed that one ordinary browser extension could influence Microsoft Edge's built-in AI agent by seizing a trusted page and using a timing flaw to switch the agent between its "think" and "act" modes, causing the agent to carry out attacker-directed actions.

    Show sources
    Open in new tab