{
  "cveId": "CVE-2016-0161",
  "url": "https://patchblox.com/security/cve/CVE-2016-0161",
  "summary": "CVE-2016-0161 is fixed in 4 products on 1 platform, first by KB3147458, released April 12, 2016. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Microsoft Edge Elevation of Privilege Vulnerability",
  "description": "\u003Cp\u003EAn elevation of privilege vulnerability exists when Microsoft Edge does not properly validate JavaScript under specific conditions, potentially allowing a script to be run with elevated privileges. In a web-based attack scenario, an attacker could host a website in an attempt to exploit this vulnerability.\u003C/p\u003E\n\u003Cp\u003EIn addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit the vulnerability. However, in all cases, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action. For example, an attacker could trick users into clicking a link that takes them to the attacker\u0027s site. An attacker who successfully exploited the vulnerability could elevate privileges in affected versions of Microsoft Edge. An attacker could then leverage these privileges with another vulnerability to run arbitrary code with medium-integrity-level privileges (permissions of the current user).\u003C/p\u003E\n\u003Cp\u003EThis vulnerability by itself does not allow arbitrary code to be run. However, this vulnerability could be used in conjunction with another vulnerability (e.g., a remote code execution vulnerability) that could take advantage of the elevated privileges when running arbitrary code. For example, an attacker could exploit another vulnerability to run arbitrary code through Microsoft Edge, but because of the context in which processes are launched by Internet Explorer, the code might be restricted to run at a low-integrity level (very limited permissions).\u003C/p\u003E\n\u003Cp\u003EHowever, an attacker could, in turn, exploit this vulnerability to cause the arbitrary code to run at a medium-integrity level (permissions of the current user).\u003C/p\u003E\n\u003Cp\u003EThe update addresses the vulnerability by adding additional permission validations to Microsoft Edge.\u003C/p\u003E",
  "published": "2016-04-12T07:00:00Z",
  "severity": "Moderate",
  "epss": 0.68094,
  "epssPercentile": 0.9933,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "exploitabilityAssessment": "Exploitation Unlikely",
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2016-0161",
  "fixes": [
    {
      "platform": "microsoft",
      "product": "Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1511 for 32-bit Systems",
      "fixedVersion": "10586.218",
      "fix": "KB3147458",
      "url": "https://patchblox.com/security/fix/microsoft/kb3147458",
      "released": "2016-04-12T00:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1511 for x64-based Systems",
      "fixedVersion": "10586.218",
      "fix": "KB3147458",
      "url": "https://patchblox.com/security/fix/microsoft/kb3147458",
      "released": "2016-04-12T00:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit Systems",
      "fixedVersion": "",
      "fix": "KB3147461",
      "url": "https://patchblox.com/security/fix/microsoft/kb3147461",
      "released": "2016-04-12T00:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Edge (EdgeHTML-based) on Windows 10 for x64-based Systems",
      "fixedVersion": "",
      "fix": "KB3147461",
      "url": "https://patchblox.com/security/fix/microsoft/kb3147461",
      "released": "2016-04-12T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T06:34:28Z"
}