EUVD-2026-41650
GHSA-mp46-jq23-75j9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered browser RCE needing only a page visit (UI:R), no auth (PR:N), low complexity, with full loss of confidentiality, integrity, and availability in the browser context.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote attacker to run arbitrary code when a victim is lured into loading attacker-controlled web content. The flaw stems from improper input validation (CWE-20) and carries a high-severity CVSS of 8.8, though it requires user interaction and has no public exploit identified at time of analysis. EPSS risk is low (0.42%, 34th percentile) and CISA SSVC currently rates exploitation status as none.
Technical ContextAI
Microsoft Edge (Chromium-based) shares the Blink/V8 engine and rendering pipeline of upstream Chromium, so parsing bugs in web content handling frequently manifest across all Chromium derivatives. The root cause is classified as CWE-20 (Improper Input Validation), meaning untrusted data reaching a component is not adequately checked before use, which in a browser context can corrupt memory or control flow during the processing of crafted web resources. The single affected component per CPE is cpe:2.3:a:microsoft:microsoft_edge_(chromium-based), and the CVSS scope is Unchanged (S:U), indicating impact confined to the browser process/security context rather than crossing into a separate system component. The 'Google' and 'Microsoft' tags suggest this likely originates from an upstream Chromium issue that Microsoft picked up in its Edge servicing.
RemediationAI
Vendor-released patch: update Microsoft Edge to 150.0.4078.48 or later, which contains the fix per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57985. Because Edge auto-updates, ensure the browser's update mechanism is not disabled and force a relaunch to apply the update across the fleet; verify the running version via edge://settings/help. If immediate patching is not possible, reduce exposure by restricting browsing to trusted sites, deploying URL/web filtering to block untrusted content, and applying enterprise policies that limit user browsing to reduce the chance a user triggers the required interaction - noting these controls degrade user convenience and do not close the underlying flaw. There are no confirmed compensating controls that fully substitute for the update, so patching remains the primary remediation.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run
Privilege elevation in Microsoft Edge (Chromium-based) lets a network attacker escalate privileges by luring a victim in
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today