Vulnerability · Published May 21, 2020 · Assigned by microsoft

CVE-2020-1195Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Low 3.1

In plain English

A low-severity security flaw in Microsoft Edge (Chromium-based) from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)2.1%top 18.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An elevation of privilege vulnerability exists in Microsoft Edge (Chromium-based) when the Feedback extension improperly validates input. An attacker who successfully exploited this vulnerability could write files to arbitrary locations and gain elevated privileges. The vulnerability by itself does not allow arbitrary code to run. However, this vulnerability could be used in conjunction with one or more vulnerabilities (for example a remote code execution vulnerability and another elevation of privilege vulnerability) to take advantage of the elevated privileges when running. The security update addresses the vulnerability by modifying how Microsoft Edge (Chromium-based) Feedback extension validates files.

Affected products (as reported)

Vendor	Product	Versions
Microsoft	Microsoft Edge (Chromium-based)	-

References

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability vendor-advisory, patch
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1195 x_refsource_MISC, x_transferred