What is the CVSS score of CVE-2025-49741?

CVE-2025-49741 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.9%.

Which versions of Edge Chromium are affected by CVE-2025-49741?

CVE-2025-49741 is a high-severity vulnerability (CVSS 7.4) affecting an unspecified product with publicly available exploit code, creating immediate risk of unauthorized access or compromise.. A patch is available.

Is there a public PoC exploit available for CVE-2025-49741?

Yes, a public proof-of-concept exploit is available for CVE-2025-49741. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2025-49741?

Within 24 hours: Identify all systems running the affected product and assess network exposure. Within 7 days: Apply vendor-released patch to all affected assets; prioritize internet-facing and critical infrastructure systems. Within 30 days: Verify patch deployment across all inventory and validate successful application through vulnerability scanning.

Edge Chromium CVE-2025-49741

EUVD-2025-19709 HIGH

Privilege Chaining (CWE-268)

2025-07-01 secure@microsoft.com

Microsoft Google Information Disclosure Edge Chromium Chrome

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:35 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

135.0.3179.98

EUVD ID Assigned

Mar 16, 2026 - 01:42 euvd

EUVD-2025-19709

Analysis Generated

Mar 16, 2026 - 01:42 vuln.today

PoC Detected

Jul 08, 2025 - 17:16 vuln.today

Public exploit code

CVE Published

Jul 01, 2025 - 23:15 nvd

HIGH 7.4

DescriptionCVE.org

No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

AnalysisAI

A security vulnerability in No cwe for this (CVSS 7.4) that allows an unauthorized attacker. Risk factors: public PoC available.

Technical ContextAI

Vulnerability type not specified by vendor. CVSS 7.4 indicates high severity. Affects No cwe for this.

RemediationAI

Monitor vendor channels for patch availability.

More in Edge Chromium

View all

CVE-2025-5419 HIGH Act Now POC

8.8 Jun 03

Chrome's V8 JavaScript engine contains an out-of-bounds read and write vulnerability (CVE-2025-5419, CVSS 8.8) enabling

CVE-2022-4135 CRITICAL Act Now POC

9.6 Nov 25

Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the r

CVE-2025-49713 HIGH This Week POC

8.8 Jul 02

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized

CVE-2023-5217 HIGH This Week POC

8.8 Sep 28

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remo

CVE-2023-4863 HIGH This Week POC

8.8 Sep 12

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to

CVE-2021-21157 HIGH This Week POC

8.8 Feb 22

Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially

CVE-2021-21128 HIGH This Week POC

8.8 Feb 09

Heap buffer overflow in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit he

CVE-2021-21127 HIGH This Week POC

8.8 Feb 09

Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass

CVE-2020-16009 HIGH This Week POC

8.8 Nov 03

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially expl

CVE-2023-24892 HIGH This Week POC

8.2 Mar 14

Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability. Rated high severity (CVSS 8.2), this vulnerability is r

CVE-2023-36887 HIGH This Week POC

7.8 Jul 14

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability

CVE-2023-33145 MEDIUM This Month POC

6.5 Jun 14

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerabili

Same weakness CWE-268 – Privilege Chaining

View all

CVE-2023-0759 HIGH POC

8.8

CVE-2024-1299 HIGH POC

8.1

CVE-2026-3888 HIGH POC

7.8

CVE-2023-5839 HIGH POC

7.8

CVE-2019-3844 HIGH POC

7.8

CVE-2024-4877 HIGH

8.8

CVE-2023-0971 HIGH

8.8

CVE-2026-32325 HIGH

8.5

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2025-49741 vulnerability details – vuln.today

Back

Edge Chromium CVE-2025-49741

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Edge Chromium

Same weakness CWE-268 – Privilege Chaining

Same technique Information Disclosure

Share

External POC / Exploit Code