Microsoft Browser Information Disclosure Vulnerability
Priority LOW 24CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit the vulnerability, in a web-based attack scenario, an attacker could host a website that is used to attempt to exploit the vulnerability. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could trick a user into clicking a link that takes the user to the attacker's site. The security update addresses the vulnerability by modifying how Microsoft browsers handle objects in memory.
Why it matters now
EPSS 0.02335 83rd percentileScored 2026-11-07
Fix Fixed Microsoft Edge (EdgeHTML-based) (Microsoft): publicationInternet Explorer 10 (Microsoft): publication+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft Edge (EdgeHTML-based) | 1.0..0 to before publication | publication | Patch available | CNA |
| Microsoft | Internet Explorer 10 | 1.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Internet Explorer 9 | 1.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Internet Explorer 11 | 1.0.0 to before publication | publication | Patch available | CNA |
- Microsoft Edge (EdgeHTML-based) VendorMicrosoft Affected 1.0..0 to before publication Fixed in publication Patch available CNA
- Internet Explorer 10 VendorMicrosoft Affected 1.0.0 to before publication Fixed in publication Patch available CNA
- Internet Explorer 9 VendorMicrosoft Affected 1.0.0 to before publication Fixed in publication Patch available CNA
- Internet Explorer 11 VendorMicrosoft Affected 1.0.0 to before publication Fixed in publication Patch available CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* | 1607 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* | 1703 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* | 1709 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:* | 1803 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* | 1809 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:* | 1903 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:* | 9 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* Versions 1607 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* Versions 1703 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* Versions 1709 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:* Versions 1803 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* Versions 1809 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:* Versions 1903 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:* Versions 9 Vulnerable ·Microsoft
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:* | 10 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:* | 11 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* | r2 sp1 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* | r2 | Running on | Microsoft |
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:* Versions 10 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:* Versions 11 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* Versions r2 sp1 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
Remediation
- Fix · CNA Microsoft Edge (EdgeHTML-based) (Microsoft) Fixed in publication
- Fix · CNA Internet Explorer 10 (Microsoft) Fixed in publication
- Fix · CNA Internet Explorer 9 (Microsoft) Fixed in publication
- Fix · CNA Internet Explorer 11 (Microsoft) Fixed in publication
Timeline
- 2026-10-02 Threatist record created from CVE-2019-1081
- 2026-10-03 Alias added: GHSA-w674-fx62-vvfq
References
More Microsoft Edge vulnerabilities
- TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2022-03781 Out-of-bounds write in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2015-00277 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-00275 Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and… KEVCVSS 3.1CRITICAL 9.8
- TI-2023-04799 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
- TI-2020-12621 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2019-1081 · CVE Program
- CVE-2019-1081 · NVD
- FIRST EPSS
- GHSA-w674-fx62-vvfq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences