What is the CVSS score of CVE-2025-49713?

CVE-2025-49713 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Edge Chromium are affected by CVE-2025-49713?

Microsoft Edge (Chromium-based) contains a type confusion vulnerability (CVSS 8.8) that permits unauthenticated remote code execution when users visit a malicious webpage.. A patch is available.

Is there a public PoC exploit available for CVE-2025-49713?

Yes, a public proof-of-concept exploit is available for CVE-2025-49713. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-49713?

Within 24 hours: Identify all Edge installations via endpoint management tools and document current versions. Within 7 days: Deploy the latest stable Microsoft Edge patch via your standard update mechanism (Microsoft releases Chromium security updates on a regular cadence; verify the specific patched version at microsoft.com/edge). Within 30 days: Audit deployment compliance and confirm 100% of Edge installations are updated; consider temporary policy restrictions on untrusted websites if patch deployment lags.

Edge Chromium CVE-2025-49713

EUVD-2025-19745 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2025-07-02 secure@microsoft.com

Microsoft Google Memory Corruption Authentication Bypass Edge Chromium Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:35 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

138.0.3351.65

EUVD ID Assigned

Mar 16, 2026 - 01:55 euvd

EUVD-2025-19745

Analysis Generated

Mar 16, 2026 - 01:55 vuln.today

PoC Detected

Jul 08, 2025 - 16:25 vuln.today

Public exploit code

CVE Published

Jul 02, 2025 - 18:15 nvd

HIGH 8.8

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Analysis

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Technical ContextAI

This vulnerability is classified as Access of Resource Using Incompatible Type (Type Confusion) (CWE-843).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

More in Edge Chromium

View all

CVE-2025-5419 HIGH Act Now POC

8.8 Jun 03

Chrome's V8 JavaScript engine contains an out-of-bounds read and write vulnerability (CVE-2025-5419, CVSS 8.8) enabling

CVE-2022-4135 CRITICAL Act Now POC

9.6 Nov 25

Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the r

CVE-2023-5217 HIGH This Week POC

8.8 Sep 28

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remo

CVE-2023-4863 HIGH This Week POC

8.8 Sep 12

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to

CVE-2021-21157 HIGH This Week POC

8.8 Feb 22

Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially

CVE-2021-21128 HIGH This Week POC

8.8 Feb 09

Heap buffer overflow in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit he

CVE-2021-21127 HIGH This Week POC

8.8 Feb 09

Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass

CVE-2020-16009 HIGH This Week POC

8.8 Nov 03

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially expl

CVE-2023-24892 HIGH This Week POC

8.2 Mar 14

Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability. Rated high severity (CVSS 8.2), this vulnerability is r

CVE-2023-36887 HIGH This Week POC

7.8 Jul 14

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability

CVE-2025-49741 HIGH This Week POC

7.4 Jul 01

A security vulnerability in No cwe for this (CVSS 7.4) that allows an unauthorized attacker. Risk factors: public PoC av

CVE-2023-33145 MEDIUM This Month POC

6.5 Jun 14

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerabili

Same weakness CWE-843 – Access of Resource Using Incompatible Type (Type Confusion)

View all

CVE-2011-0611 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2017-8291 HIGH POC

7.8

CVE-2016-7201 HIGH POC

8.8

CVE-2017-0037 HIGH POC

8.1

CVE-2017-5070 HIGH POC

8.8

CVE-2025-30397 HIGH POC

7.5

CVE-2016-0985 HIGH POC

8.8

Same technique Memory Corruption

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2010-3333 HIGH POC

7.8

CVE-2025-49713 vulnerability details – vuln.today

Back

Edge Chromium CVE-2025-49713

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in Edge Chromium

Same weakness CWE-843 – Access of Resource Using Incompatible Type (Type Confusion)

Same technique Memory Corruption

Share

External POC / Exploit Code