CVE-2025-49741: microsoft edge_chromium Privilege Chaining
CVSS: 7.5v3.1HighModified
Published 01-07-2025Last modified 13-02-2026
Vulnerability summary
CVE-2025-49741 is a high (CVSS 7.5) Privilege Chaining vulnerability in microsoft edge_chromium. EPSS estimates a 3.91% chance of exploitation in the next 30 days, higher than 90.2% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
3.91%
0%100%
Low · +0.30 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1exploit-database
Timeline
- 01-07-2025PublishedVulnerability first disclosed.
- 13-02-2026Last modifiedVulnerability information updated.
Description
No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVSS metrics
2 scores · 2 sources · 1 versionHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSources2 sources · 7.4–7.5
- CVE.orgCNA7.4HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:CDiffers
EPSS trend
Probability
3.91%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
+0.30 pp
From 3.61% on 21-09-2026
21-09-202621-10-2026
EPSS score3.91%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundMicrosoft Edge (Chromium-based) 135.0.7049.114/.115 - Information Disclosure
Maturity: poc
Weaknesses
CWE · root cause- CWE-268Privilege ChainingTwo distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Microsoft2 products
- edge_chromium< 135.0.3179.98
- microsoft edge (chromium-based)≥ 1.0.0.0, < 135.0.3179.98
1 vendor · 2 products
