What is the CVSS score of CVE-2026-50521?

CVE-2026-50521 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.8%.

Which versions of Microsoft Edge are affected by CVE-2026-50521?

Microsoft Edge is affected by a high-severity remote code execution vulnerability (CVE-2026-50521, CVSS 8.3) that could allow attackers to execute arbitrary code within the browser process.. A patch is available.

How to fix or mitigate CVE-2026-50521?

Within 24 hours: Quantify Edge deployment footprint across the organization and prioritize systems handling sensitive data. Within 7 days: Deploy vendor-released patch to non-production pilot group and validate compatibility with business applications. Within 30 days: Complete patch deployment across all production Edge endpoints.

Microsoft Edge CVE-2026-50521

EUVD-2026-41137 HIGH

Use After Free (CWE-416)

2026-07-01 microsoft

GHSA-q4g4-rw2v-x4v7

Memory Corruption Google Microsoft Denial Of Service Use After Free Microsoft Edge Chromium Based

8.3

CVSS 3.1 · Vendor: microsoft

Temporal: 7.2

Severity by source

Vendor (microsoft) PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

CIRCL (temporal)

7.2 HIGH

cvss

vuln.today AI

7.6 HIGH

Network-reachable low-complexity UAF, but browser exploitation realistically needs victim to render attacker content (UI:R) and some privilege (PR:L); C/I high, A partial per vendor.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 20:52 vuln.today

CVE Published

Jul 01, 2026 - 20:14 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw that lets an authorized attacker run arbitrary code over a network within the browser process. Microsoft has shipped an official fix and rates it CVSS 8.3; the exploit-maturity metric is Unproven (E:U), meaning no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high to confidentiality and integrity with partial availability loss, making it a meaningful but not emergency patch priority for Edge-based endpoints.

Technical ContextAI

The flaw is a use-after-free (CWE-416) in Microsoft Edge, which is built on the Chromium open-source engine (Blink rendering, V8 JavaScript). Use-after-free occurs when a program continues to reference heap memory after it has been freed, allowing an attacker who controls subsequent allocations to place crafted data in the reclaimed region and hijack a dangling pointer, typically leading to controlled code execution in the renderer or browser process. The affected product per the CPE is cpe:2.3:a:microsoft:microsoft_edge_(chromium-based), and the shared Chromium codebase means the underlying defect class frequently mirrors upstream Chromium/Google bugs, consistent with the 'Google' and 'Memory Corruption' tags on this record.

RemediationAI

Apply the vendor fix: Patch available per vendor advisory - update Microsoft Edge to the current patched Stable channel build via Edge's built-in update mechanism (edge://settings/help) or your enterprise update ring/WSUS/Intune deployment, referencing https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50521 for the exact fixed version, which is not enumerated in the provided data. Because Edge auto-updates by default, ensure automatic updates are not disabled by policy and force a browser restart to complete installation. As a compensating control until patched, restrict browsing to trusted sites (block untrusted web content at a secure web gateway or via SmartScreen/URL allowlisting) to reduce exposure to attacker-controlled pages that could trigger the use-after-free - trade-off being reduced user browsing flexibility; no availability-safe workaround exists that preserves normal browser use, so patching is the definitive remedy.