CVE-2026-0102

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0102", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2025-10-17T23:35:05.037Z", "datePublished": "2026-02-17T19:14:32.901Z", "dateUpdated": "2026-08-19T16:25:59.724Z"}, "containers": {"cna": {"title": "Microsoft Edge (Chromium-based) Defense in Depth Vulnerability", "datePublic": "2026-02-17T16:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0.0", "versionEndExcluding": "145.0.3800.58"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "versions": [{"version": "1.0.0.0", "lessThan": "145.0.3800.58", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consent. This could result in disclosure of stored autofill data such as addresses, email, or phone number metadata.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-359: Exposure of Private Personal Information to an Unauthorized Actor", "lang": "en-US", "type": "CWE", "cweId": "CWE-359"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-08-19T16:25:59.724Z"}, "references": [{"name": "Microsoft Edge (Chromium-based) Defense in Depth Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-0102"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "LOW", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-21T21:13:58.897946Z", "id": "CVE-2026-0102", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:56:52.592Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0102", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-21T21:13:58.897946Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:56:48.046Z"}}], "cna": {"title": "Microsoft Edge (Chromium-based) Defense in Depth Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "versions": [{"status": "affected", "version": "1.0.0.0", "lessThan": "145.0.3800.58", "versionType": "custom"}]}], "datePublic": "2026-02-17T16:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-0102", "name": "Microsoft Edge (Chromium-based) Defense in Depth Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consent. This could result in disclosure of stored autofill data such as addresses, email, or phone number metadata."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-359", "description": "CWE-359: Exposure of Private Personal Information to an Unauthorized Actor"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "145.0.3800.58", "versionStartIncluding": "1.0.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-08-19T16:25:59.724Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0102", "state": "PUBLISHED", "dateUpdated": "2026-08-19T16:25:59.724Z", "dateReserved": "2025-10-17T23:35:05.037Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-02-17T19:14:32.901Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Microsoft Edge (Chromium-based)", "vendor": "Microsoft", "versions": [{"lessThan": "145.0.3800.58", "status": "affected", "version": "1.0.0.0", "versionType": "custom"}]}], "source": "secure@microsoft.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*", "matchCriteriaId": "7625822C-F0EF-4A29-B90B-7B4E15C8E3C2", "versionEndExcluding": "145.0.3800.58", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consent. This could result in disclosure of stored autofill data such as addresses, email, or phone number metadata."}, {"lang": "es", "value": "Bajo condiciones espec\u00edficas, una p\u00e1gina web maliciosa puede activar el llenado autom\u00e1tico despu\u00e9s de dos toques consecutivos, potencialmente sin el consentimiento claro o intencional del usuario. Esto podr\u00eda resultar en la divulgaci\u00f3n de datos de autocompletado almacenados, como direcciones, correo electr\u00f3nico o metadatos de n\u00fameros de tel\u00e9fono."}], "id": "CVE-2026-0102", "lastModified": "2026-06-17T10:10:24.837", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "secure@microsoft.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0102", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-21T21:13:58.897946Z", "version": "2.0.3"}}]}, "published": "2026-02-17T20:22:05.500", "references": [{"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-0102"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-359"}], "source": "secure@microsoft.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.0.0,145.0.3800.58)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Microsoft Edge (Chromium-based)", "source": "cna", "vendor": "Microsoft"}, "product": "edge_chromium", "vendor": "microsoft"}], "analysis": {"en": {"generated_at": "2026-04-15T17:09:23.622499+00:00", "value": {"mitigation_remediation": ["Update Microsoft Edge to the latest available version to apply the vendor\u2019s security fix for the autofill issue.", "As a temporary mitigation, disable or restrict the browser\u2019s autofill feature in the settings to prevent unintended exposure of stored data.", "Continuously monitor Microsoft security updates and apply subsequent patches; audit browser configuration to ensure sensitive autofill data is managed according to organizational privacy policy."], "summary": {"action": "Patch", "impact": "Sensitive data exposure via autofill leakage"}, "threat_synthesis": {"affected_systems": "Microsoft Edge (Chromium-based) is the affected vendor and product. No specific version range is listed, so all installations of this browser may be vulnerable until a patch is applied.", "description_and_impact": "Under certain conditions a malicious web page can trigger the autofill mechanism after the user taps twice on the page, potentially without clear or intentional user consent. When activated, stored autofill data\u2014including addresses, email addresses, and phone number metadata\u2014can be disclosed inadvertently. This vulnerability falls under CWE\u2011359, Sensitive Data Exposure, and allows an attacker to obtain personal data that the user has stored locally in the browser.", "risk_and_exploitability": "The CVSS score is 3.1, indicating low severity, and the EPSS score is less than 1\u202f%, suggesting a very low probability of exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to open a malicious or compromised web page and interact with it by tapping the page twice. The attack vector is therefore a web-based user interaction; no remote code execution or privilege escalation beyond data disclosure is possible according to the current description."}}}}, "created": "2026-02-18T10:33:33.404163+00:00", "updated": "2026-04-15T17:30:10.458042+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$edge_chromium"]}