What is the CVSS score of CVE-2026-57981?

CVE-2026-57981 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Microsoft Edge are affected by CVE-2026-57981?

A critical remote code execution vulnerability in Microsoft Edge creates endpoint compromise risk for all users who visit malicious websites, potentially exposing organizational credentials and…. A patch is available.

How to fix or mitigate CVE-2026-57981?

24 hours: Conduct inventory of all Microsoft Edge deployments across endpoints and identify currently installed versions. 7 days: Deploy vendor patch to 100% of affected Edge installations using your existing software deployment tools or manual update mechanisms. 30 days: Confirm patch compliance across all endpoints through inventory or automated reporting; review security logs and telemetry for any exploitation attempts targeting this CVE.

Microsoft Edge CVE-2026-57981

EUVD-2026-41577 HIGH

Use After Free (CWE-416)

2026-07-03 microsoft

GHSA-7x68-7683-mh57

Memory Corruption Google Microsoft Denial Of Service Use After Free Microsoft Edge Chromium Based

8.8

CVSS 3.1 · Vendor: microsoft

Temporal: 7.7

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.7 HIGH

cvss

vuln.today AI

8.8 HIGH

Network-delivered malicious page (AV:N/AC:L/PR:N) requiring the victim to browse to it (UI:R); renderer code execution gives full C/I/A impact with unchanged scope (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:25 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) that lets an unauthenticated attacker run arbitrary code when a victim visits a malicious web page. All Edge Chromium versions prior to the vendor-patched build are affected, and the CVSS 3.1 base score is 8.8 (High). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host malicious web page

Delivery

Lure victim to visit (UI:R)

Exploit

Trigger use-after-free in renderer

Execution

Reclaim freed object with controlled data

Persist

Hijack control flow

Impact

Execute code in renderer context

Access

Host malicious web page

Delivery

Lure victim to visit (UI:R)

Exploit

Trigger use-after-free in renderer

Execution

Reclaim freed object with controlled data

Persist

Hijack control flow

Impact

Execute code in renderer context

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to actively browse to or interact with attacker-controlled web content (UI:R in the CVSS vector) using a vulnerable, unpatched Microsoft Edge (Chromium-based) build - there is no server-side or unattended trigger. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are moderately-to-strongly concerning but not emergency-tier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a malicious web page containing JavaScript that triggers the use-after-free in Edge's rendering/JS engine and lures a victim to visit it via phishing, malvertising, or a compromised site. When the victim opens the page (satisfying the UI:R requirement) the dangling pointer is reclaimed with attacker-controlled data, hijacking execution to run code in the renderer context. …
Remediation	Patch available per vendor advisory - update Microsoft Edge to the fixed build published by Microsoft; the exact fixed version is listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57981 (the provided data does not enumerate a specific version number, so do not assume one). … Detailed patch versions, workarounds, and compensating controls in full report.