What is the CVSS score of CVE-2026-57984?

CVE-2026-57984 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Edge are affected by CVE-2026-57984?

Microsoft Edge contains a remote code execution vulnerability (CVE-2026-57984) that can be triggered when users visit attacker-controlled websites, creating direct risk to employee endpoints and…. A patch is available.

How to fix or mitigate CVE-2026-57984?

Within 24 hours: Assess Microsoft Edge deployment scope across infrastructure and initiate patch distribution planning with IT operations. Within 7 days: Deploy the latest Microsoft Edge security update containing the CVE-2026-57984 fix to all organizational endpoints via standard patch management processes. Within 30 days: Confirm 100% deployment compliance and review endpoint telemetry for any exploitation attempts occurring before patch application.

Microsoft Edge CVE-2026-57984

EUVD-2026-41649 HIGH

Use After Free (CWE-416)

2026-07-03 microsoft

GHSA-wf54-w5mv-jcf9

Memory Corruption Google Microsoft Denial Of Service Use After Free Microsoft Edge Chromium Based

7.5

CVSS 3.1 · NVD

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

HIGH

qualitative

NVD

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.5 MEDIUM

cvss

vuln.today AI

7.5 HIGH

Remote drive-by via web content needs no auth (PR:N) but requires the victim to load a page (UI:R) and non-trivial heap grooming (AC:H); a renderer UAF yields full C/I/A compromise within the process (S:U).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:10 vuln.today

CVE Published

Jul 03, 2026 - 20:35 cve.org

HIGH 7.5

DescriptionNVD

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw that an unauthenticated attacker can trigger over the network when a victim loads attacker-controlled web content. Microsoft has released an official fix and rates the issue 7.5 (High), tempered by high attack complexity and required user interaction; the CVSS temporal data marks exploit maturity as Unproven (E:U), so there is no public exploit identified at time of analysis and no CISA KEV listing. The vendor tags ('Google', 'Use After Free', 'Denial Of Service') indicate this most likely tracks an upstream Chromium engine defect inherited by Edge.

Technical ContextAI

Microsoft Edge (Chromium-based) shares Google Chrome's Blink rendering and V8 JavaScript engine, so memory-safety defects in the upstream Chromium code base are typically inherited by Edge and patched in lockstep - consistent with the 'Google' tag on this record. The root cause is a use-after-free (CWE-416): an object is freed while a dangling pointer to it remains reachable, and subsequent access to that reclaimed memory allows heap corruption. In a browser renderer, a well-crafted UAF can be groomed into a controlled read/write primitive and escalated toward arbitrary code execution within the renderer process. The single affected CPE, cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*, scopes this to the Chromium-based Edge product line rather than the legacy EdgeHTML browser.

RemediationAI

Patch available per vendor advisory: update Microsoft Edge to the current patched build via the browser's built-in updater (edge://settings/help) or your managed-update tooling, then restart the browser to apply it; consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57984 for the exact fixed version. In enterprises, confirm that Edge automatic updates are not disabled by policy and push the update through Microsoft Update/WSUS/Intune or your EMM. As an interim compensating control before patching, reduce exposure by restricting browsing to trusted destinations, enabling Edge's Enhanced Security Mode (which applies additional runtime hardening that raises the bar for renderer memory-corruption exploits, at some cost to site performance and compatibility), and using web/DNS filtering to block untrusted sites - none of these substitutes for the update, which is the only complete fix.