CVE-2026-21223
📋 TL;DR
This vulnerability allows a standard local user without administrative privileges to execute privileged update commands via Microsoft Edge's Elevation Service. By exploiting the IElevatorEdge interface, attackers can modify protected system registry keys to disable Windows Virtualization-Based Security (VBS), weakening critical platform protections. This affects Windows systems with Microsoft Edge installed where users have local access.
💻 Affected Systems
- Microsoft Edge
📦 What is this software?
Edge Chromium by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
An attacker disables VBS protections (Credential Guard, HVCI, Secure Kernel), enabling credential theft, malware persistence, and privilege escalation attacks that would normally be blocked.
Likely Case
Local users disable VBS to bypass security controls for credential theft or malware installation, compromising the host's security posture.
If Mitigated
With proper access controls and monitoring, exploitation attempts are detected and blocked before VBS is disabled.
🎯 Exploit Status
Exploitation requires local user access but no special privileges; method LaunchUpdateCmdElevatedAndWait is directly callable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update Guide for specific Edge version
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21223
Restart Required: Yes
Instructions:
1. Apply latest Microsoft Edge security update via Windows Update. 2. Restart system to ensure Edge Elevation Service is updated. 3. Verify VBS remains enabled post-patch.
🔧 Temporary Workarounds
Disable Edge Elevation Service
windowsTemporarily disable the vulnerable service to prevent exploitation.
sc config EdgeElevationService start= disabled
sc stop EdgeElevationService
Restrict COM Interface Access
windowsUse Component Services (dcomcnfg) to modify permissions on IElevatorEdge interface.
🧯 If You Can't Patch
- Implement strict local user access controls and monitor for unauthorized privilege escalation attempts.
- Enable enhanced auditing for registry modifications under HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard.
🔍 How to Verify
Check if Vulnerable:
Check if Edge Elevation Service is running and if unpatched Edge version is installed.Check Version:
msedge --versionVerify Fix Applied:
Verify Edge is updated to patched version and test that LaunchUpdateCmdElevatedAndWait no longer allows VBS modification.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs: Process creation by EdgeElevationService with elevated privileges
- Registry modification events for DeviceGuard keys
Network Indicators:
- None - local exploitation only
SIEM Query:
EventID=4688 AND ProcessName="EdgeElevationService.exe" AND IntegrityLevel="System"