EUVD-2026-41575
GHSA-mcm4-vwcv-x3pp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered malicious page needing a victim to load it (AV:N/UI:R), no privileges (PR:N), low complexity, and memory-corruption RCE yields full C/I/A within the unchanged browser scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by luring a victim to a malicious web page that triggers an integer overflow (CWE-190). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) indicates network-based exploitation requiring user interaction, with high confidentiality, integrity, and availability impact. Microsoft has released a fix; no public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Technical ContextAI
Microsoft Edge is Microsoft's Chromium-based web browser, so this class of defect typically resides in the shared Chromium/Blink/V8 engine code that parses and processes untrusted web content. CWE-190 (Integer Overflow or Wraparound) means an arithmetic operation - often a size or length calculation - exceeds its integer type's range and wraps around, producing an undersized buffer allocation or an out-of-bounds index. This commonly leads to heap buffer overflow (reflected in the 'Buffer Overflow' tag) and subsequent memory corruption that an attacker can shape into control-flow hijacking and code execution within the renderer process. The 'Google' tag and Microsoft/Edge tags suggest the root cause likely originates in upstream Chromium code that Microsoft inherits and patches. The single affected CPE is cpe:2.3:a:microsoft:microsoft_edge_(chromium-based), with no explicit version boundaries enumerated in the data.
RemediationAI
Patch available per vendor advisory: update Microsoft Edge to the fixed build published by Microsoft, consulting the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57974 for the exact patched version number, which is not stated in the available data. Edge typically auto-updates, so ensure automatic updates are enabled and force a restart of the browser to apply the fix; in managed environments, push the updated build via your endpoint management or update-ring policy and verify version compliance. Until every endpoint is patched, reduce exposure by cautioning users against opening untrusted links and by restricting browsing to trusted sites through web filtering, accepting that this hampers legitimate browsing; there is no feature-specific toggle disclosed to disable, so patching is the definitive control.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run
Privilege elevation in Microsoft Edge (Chromium-based) lets a network attacker escalate privileges by luring a victim in
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today