Multiple Vulnerabilities in Microsoft Edge (Chromium) and Visual Studio 2017-2026 - HK GovCERT Alert A26-11-02 (CVE-2026-91732, CVE-2026-118147, CVE-2026-118322)

Key facts for Edge and Visual Studio flaws

Detection coverage for Edge and Visual Studio flaws

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5450 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Edge/WebView2 Spawning Shell or LOLBin (CVE-2026-91732 / CVE-2026-118322 Exploitation) — SPL

Detects msedge.exe or msedgewebview2.exe spawning a command shell, script host or common LOLBin (cmd, PowerShell, wscript, mshta, rundll32, regsvr32, certutil, bitsadmin). A healthy Chromium browser rarely launches these, so this is a high-value post-exploitation signal for client-side Edge/Chromium exploitation such as the AppManifest origin-policy bypass (CVE-2026-91732, CWE-862) and the ANGLE out-of-sandbox memory read (CVE-2026-118322, CWE-908) rolled up in HK GovCERT A26-11-02 (TL-2026-5450). The Edge process type (renderer, gpu-process, utility) is extracted from the parent command line because ANGLE runs in the GPU process and renderer compromise is a stated precondition of CVE-2026-91732; children of those process types, or children that fetch remote content (certutil -urlcache, bitsadmin /transfer, http URLs: T1105), are scored high. No in-the-wild exploitation is reported, so this is behaviour-first coverage of drive-by delivery (T1189) and client exploitation (T1203, T1211). Community OSINT matched four fake-installer/phishing campaigns (fake Chrome ZIP, Teams MSI/EXE lures) with no IOC overlap; they are low/medium-confidence corroboration only.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1189, T1203, T1211, T1059, T1218, T1105
• Data sources: sysmon, windows_process_creation, microsoft_defender_for_endpoint
• Severity: high
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
(ParentImage="*\\msedge.exe" OR ParentImage="*\\msedgewebview2.exe")
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe")
| rex field=ParentCommandLine "--type=(?<edge_proc_type>[a-z]+(-[a-z]+)?)"
| eval edge_proc_type=coalesce(edge_proc_type, "browser")
| eval ingress_tool=if(match(CommandLine, "(?i)(urlcache|bitsadmin.*/transfer|https?://)"), "yes", "no")
| eval risk=if(match(edge_proc_type, "^(renderer|gpu-process|utility)$") OR ingress_tool="yes", "high", "medium")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as child_cmdline values(ParentCommandLine) as parent_cmdline by host, User, ParentImage, Image, edge_proc_type, ingress_tool, risk
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Microsoft KQL

let EdgeParents = dynamic(["msedge.exe", "msedgewebview2.exe"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (EdgeParents)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe")
| extend EdgeProcType = extract(@"--type=([a-z]+(-[a-z]+)?)", 1, InitiatingProcessCommandLine)
| extend EdgeProcType = iff(isempty(EdgeProcType), "browser", EdgeProcType)
| extend IngressTool = ProcessCommandLine matches regex @"(?i)(urlcache|bitsadmin.*/transfer|https?://)"
| extend Risk = iff(EdgeProcType in ("renderer", "gpu-process", "utility") or IngressTool, "high", "medium")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, EdgeProcType, IngressTool, Risk, FileName, ProcessCommandLine, InitiatingProcessParentFileName
| order by Timestamp desc

Sigma

title: Microsoft Edge Browser Process Spawning Script Interpreter or LOLBin
id: 3f6c1a52-8d47-4b19-a0e5-7c2b9d41e6a1
status: experimental
description: Detects msedge.exe or msedgewebview2.exe spawning a shell, script host or common LOLBin, a post-exploitation indicator for Chromium/Edge browser exploitation such as CVE-2026-91732 and CVE-2026-118322 (TL-2026-5450).
references:
    - https://www.govcert.gov.hk/en/alerts_detail.php?id=2157
    - https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.initial-access
    - attack.t1189
    - attack.execution
    - attack.t1203
    - attack.t1059
    - attack.stealth
    - attack.t1211
    - attack.t1218
    - attack.command-and-control
    - attack.t1105
    - cve.2026.91732
    - cve.2026.118322
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\msedge.exe'
            - '\msedgewebview2.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Enterprise web apps or extensions that launch helper scripts through a native messaging host or protocol handler
    - Developers debugging WebView2-hosted applications
level: high

Known false positives:

• Enterprise web apps or browser extensions that launch helper scripts via native messaging hosts or custom protocol handlers
• Developers debugging WebView2-hosted applications that legitimately shell out

Tuning notes: Allowlist known native-messaging helpers by exact ParentCommandLine and child CommandLine rather than by image. Page on risk=high (renderer/gpu-process/utility parent or remote fetch in the child command line). Pair with an Edge version inventory (fixed build 156.0.4314.58; upstream Chromium 153.0.8010.47 / 156.0.8078.73) to prioritise unpatched hosts.

• 🔒 Edge/WebView2 Spawning Shell or LOLBin (CVE-2026-91732 / CVE-2026-118322 Exploitation) — KQL · unlock with TL Creds
• 🔒 Root Certificate Store Tampering for Trust Subversion (CVE-2026-118147 Spoofing Enablement) — KQL · unlock with TL Creds
• 🔒 Visual Studio Tooling Spoofing/AiTM Hunt: Non-Microsoft Connections or LOLBin Children (CVE-2026-118147) — KQL · unlock with TL Creds
• 🔒 Edge/WebView2 Spawning Shell or LOLBin (CVE-2026-91732 / CVE-2026-118322 Exploitation) — Sigma · unlock with TL Creds
• 🔒 Root Certificate Store Tampering for Trust Subversion (CVE-2026-118147 Spoofing Enablement) — Sigma · unlock with TL Creds
• 🔒 Visual Studio Tooling Spoofing/AiTM Hunt: Non-Microsoft Connections or LOLBin Children (CVE-2026-118147) — Sigma · unlock with TL Creds
• 🔒 Root Certificate Store Tampering for Trust Subversion (CVE-2026-118147 Spoofing Enablement) — SPL · unlock with TL Creds
• 🔒 Visual Studio Tooling Spoofing/AiTM Hunt: Non-Microsoft Connections or LOLBin Children (CVE-2026-118147) — SPL · unlock with TL Creds

Indicators of compromise for Edge and Visual Studio flaws

As of 2026-11-06, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5450.

How Edge and Visual Studio flaws works

HK GovCERT published Security Alert A26-11-02 on 2026-11-02 covering Microsoft Edge versions before 156.0.4314.58 and Microsoft Visual Studio 2017, 2019, 2022 and 2026. The alert states that successful exploitation could enable remote code execution, information disclosure, security restriction bypass, spoofing or tampering. It lists CVE-2026-91732, CVE-2026-118147, CVE-2026-118322 individually plus the ranges CVE-2026-118304 to 118308, 118310 to 118313, 118315 to 118320 and 118327 to 118359. The ranges are not expanded in this record because the alert does not enumerate them; only the three individually listed CVEs were checked against NVD.

NVD detail for the three individually listed CVEs: (1) CVE-2026-91732 is a missing authorization flaw (CWE-862) in the AppManifest component of Chromium/Google Chrome prior to 153.0.8010.47. It allows a remote attacker who has already compromised the renderer process and who leverages social engineering to bypass web origin policy via a crafted HTML page. NVD scores it 8.1 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N); a secondary source scores it 3.1 LOW. It was published 2026-09-15. (2) CVE-2026-118147 is an improper certificate validation flaw (CWE-295) in Visual Studio that lets an unauthorized attacker perform spoofing over a network. NVD scores it 7.4 HIGH (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) and lists fixed builds 15.9.84 (VS 2017), 16.11.62 (VS 2019), 17.14.44 (VS 2022) and 18.11.3 (VS 2026). It was published 2026-10-31 and is awaiting analysis. (3) CVE-2026-118322 is an uninitialized resource flaw (CWE-908) in ANGLE in Chromium/Google Chrome prior to 156.0.8078.73 that lets a remote attacker read memory outside the sandbox via a crafted HTML page. NVD scores it 4.3 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) and Chromium rates it High. It was published 2026-10-27.

Related context: HKCERT bulletin of 2026-10-27 covers Edge prior to 156.0.4314.42 (CVE-2026-112992 through CVE-2026-113344, rated Medium risk), which this alert's 156.0.4314.58 build supersedes. The alert provides no CVSS, exploitation status, PoC or IOCs. A partial read of the CISA KEV catalog did not show the three CVEs, but the catalog was not read in full, so KEV status is unconfirmed. No network IOCs exist, so no BeaconBeagle correlation was applicable. This record is a patch-advisory roll-up; severity is set from the highest sourced CVSS among the three NVD-checked CVEs (8.1) and should be revisited if exploitation is reported.

MITRE ATT&CK techniques by tactic:

Execution

T1203 Exploitation for Client Execution

Stealth

T1211 Exploitation for Stealth

defense-impairment

T1553 Subvert Trust Controls

Credential Access

T1557 Adversary-in-the-Middle

Remediation for Edge and Visual Studio flaws

Patches

• Microsoft Edge 156.0.4314.58 or later
• Visual Studio 2017 v15.9.84 or later
• Visual Studio 2019 v16.11.62 or later
• Visual Studio 2022 v17.14.44 or later
• Visual Studio 2026 v18.11.3 or later (fixed builds listed by NVD for CVE-2026-118147)

Immediate actions

• Update Microsoft Edge to version 156.0.4314.58 or later
• Apply Microsoft patches for all installed Visual Studio versions (2017, 2019, 2022, 2026)

Longer-term hardening

• Track Microsoft Edge security release notes and Visual Studio release notes for new fixes
• Inventory Edge and Visual Studio versions across developer and user endpoints

Affected and fixed versions

• Microsoft — Microsoft Edge (Chromium-based)
  Vulnerable versions: prior to 156.0.4314.58
  Fixed in: 156.0.4314.58 or later
• Microsoft — Visual Studio 2017
  Vulnerable versions: 15.9 before 15.9.84
  Fixed in: 15.9.84
• Microsoft — Visual Studio 2019
  Vulnerable versions: 16.11 before 16.11.62
  Fixed in: 16.11.62
• Microsoft — Visual Studio 2022
  Vulnerable versions: 17.14 before 17.14.44
  Fixed in: 17.14.44
• Microsoft — Visual Studio 2026
  Vulnerable versions: 18.11 before 18.11.3
  Fixed in: 18.11.3

Timeline of Edge and Visual Studio flaws

• 2026-09-15 CVE-2026-91732 (AppManifest missing authorization, Chromium prior to 153.0.8010.47) published to NVD
• 2026-10-27 CVE-2026-118322 (ANGLE uninitialized resource, Chromium prior to 156.0.8078.73) published to NVD
• 2026-10-27 HKCERT publishes bulletin for locked-ioc-12 Edge prior to 156.0.4314.42 (CVE-2026-112992 to CVE-2026-113344, Medium risk)
• 2026-10-30 locked-ioc-12 Edge security release notes dated 2026-10-30 referenced by the locked-ioc-11 alert
• 2026-10-31 CVE-2026-118147 (Visual Studio improper certificate validation, CVSS 7.4) published to NVD; fixed builds 15.9.84, 16.11.62, 17.14.44, 18.11.3
• 2026-11-02 locked-ioc-11 publishes Security Alert A26-11-02 for Edge prior to 156.0.4314.58 and Visual Studio 2017/2019/2022/2026
• 2026-11-06 NVD last modified CVE-2026-118147; entry still awaiting analysis

Sources cited for Edge and Visual Studio flaws

• Security Alert (A26-11-02): Multiple Vulnerabilities in Microsoft Products govcert.gov.hk · Advisory · 2026-11-02
• HKCERT: Microsoft Edge Multiple Vulnerabilities hkcert.org · Advisory · 2026-10-27
• Canadian Centre for Cyber Security: Microsoft Edge security advisory (AV26-143) cyber.gc.ca · Advisory
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-11-06
• NVD: CVE-2026-91732 NVD (NIST) · Research · 2026-09-15
• NVD: CVE-2026-118147 NVD (NIST) · Research · 2026-10-31
• NVD: CVE-2026-118322 NVD (NIST) · Research · 2026-10-27
• MSRC Update Guide: CVE-2026-118147 Microsoft Security Response Center · Vendor report · 2026-10-31
• Microsoft Edge Security Release Notes Microsoft · Vendor report · 2026-10-30
• Chromium Issue 511062248 (CVE-2026-91732) issues.chromium.org · Research · 2026-09-15

More in vulnerability

• Siemens SSA-827968: Multiple Vulnerabilities in Nozomi Guardian/CMC < V26.2.0 on RUGGEDCOM APE1808 (17 CVEs)
• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)
• Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)
• Siemens SSA-364175: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 (CVE-2024-3596, CVE-2025-4231 and others)

Previous and next in vulnerability

• Multiple Vulnerabilities in Google Chrome prior to 157.0.8103.38 (CVE-2026-121029 through CVE-2026-121257) - HK GovCERT Alert A26-11-05 Previous report
• Vulnerability in F5 Products (CVE-2020-26116) - Python http.client CRLF Injection in BIG-IP Next SPK, BIG-IQ, F5OS-A, F5OS-C Next report

Further reading

• Edge RCEs: Cisco SD-WAN, Fortinet, NGINX, Exim