What is the CVSS score of CVE-2026-57981?

CVE-2026-57981 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Microsoft Edge are affected by CVE-2026-57981?

A critical remote code execution vulnerability in Microsoft Edge creates endpoint compromise risk for all users who visit malicious websites, potentially exposing organizational credentials and…. A patch is available.

How to fix or mitigate CVE-2026-57981?

24 hours: Conduct inventory of all Microsoft Edge deployments across endpoints and identify currently installed versions. 7 days: Deploy vendor patch to 100% of affected Edge installations using your existing software deployment tools or manual update mechanisms. 30 days: Confirm patch compliance across all endpoints through inventory or automated reporting; review security logs and telemetry for any exploitation attempts targeting this CVE.

Microsoft Edge CVE-2026-57981

EUVD-2026-41577 HIGH

Use After Free (CWE-416)

2026-07-03 microsoft

GHSA-7x68-7683-mh57

Denial Of Service Google Use After Free Memory Corruption Microsoft Microsoft Edge Chromium Based

8.8

CVSS 3.1 · Vendor: microsoft

Temporal: 7.7

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.7 HIGH

cvss

vuln.today AI

8.8 HIGH

Network-delivered malicious page (AV:N/AC:L/PR:N) requiring the victim to browse to it (UI:R); renderer code execution gives full C/I/A impact with unchanged scope (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:25 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) that lets an unauthenticated attacker run arbitrary code when a victim visits a malicious web page. All Edge Chromium versions prior to the vendor-patched build are affected, and the CVSS 3.1 base score is 8.8 (High). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation requires user interaction such as browsing to attacker-controlled content.

Technical ContextAI

Microsoft Edge (Chromium-based) shares the Blink/V8 rendering and JavaScript engine codebase with upstream Google Chromium, which is reflected in the 'Google' tag on this advisory - many Edge memory-safety fixes track Chromium security releases. The root cause is a use-after-free (CWE-416): a heap object is freed but a dangling pointer to it is subsequently dereferenced, allowing an attacker to groom the heap, reclaim the freed allocation with controlled data, and hijack control flow. Because the browser processes untrusted HTML/JS/CSS from any visited site, such flaws in the renderer are a classic path to arbitrary code execution within the renderer sandbox. The affected CPE is cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*, i.e. the Chromium-based Edge application across versions up to the fix.

RemediationAI

Patch available per vendor advisory - update Microsoft Edge to the fixed build published by Microsoft; the exact fixed version is listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57981 (the provided data does not enumerate a specific version number, so do not assume one). Edge auto-updates by default, so the primary action is to ensure the browser is restarted to apply the pending update and to force the update in managed environments via 'edge://settings/help' or your management tooling (Intune/WSUS/Configuration Manager). As a compensating control until patching completes, restrict browsing of untrusted sites, deploy web filtering/proxy controls to reduce exposure to malicious pages, and enable/enforce Microsoft Defender SmartScreen and site isolation policies - the trade-off is reduced usability and no guarantee against a targeted lure. There is no reason to disable Edge outright given a fix is available; prioritize the update.