What is the CVSS score of CVE-2026-57986?

CVE-2026-57986 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Edge are affected by CVE-2026-57986?

Microsoft Edge vulnerability CVE-2026-57986 (CVSS 7.5) enables unauthenticated remote code execution when users interact with attacker-controlled web content.. A patch is available.

How to fix or mitigate CVE-2026-57986?

Within 24 hours: Identify all systems running Microsoft Edge and determine scope of vulnerable versions. Within 7 days: Deploy Microsoft Edge patch per vendor advisory to all affected systems. Within 30 days: Verify patch deployment and report completion of remediation.

Microsoft Edge CVE-2026-57986

EUVD-2026-41578 HIGH

Use After Free (CWE-416)

2026-07-03 microsoft

GHSA-7q4c-v8r2-pc77

Denial Of Service Google Use After Free Memory Corruption Microsoft Microsoft Edge Chromium Based

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.5 MEDIUM

cvss

vuln.today AI

7.5 HIGH

Network-delivered via web content (AV:N) but needs victim interaction (UI:R) and non-trivial heap grooming (AC:H), no privileges (PR:N); renderer-context RCE yields full C/I/A impact within unchanged scope.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:27 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory-corruption bug (CWE-416) that an unauthorized attacker can trigger over the network to run arbitrary code in the browser's context. Exploitation requires the victim to interact with attacker-controlled web content and the CVSS vector flags high attack complexity, so successful attacks are not trivial. There is no public exploit identified at time of analysis and no CISA KEV listing, but a vendor patch is available from Microsoft.

Technical ContextAI

The vulnerability is a use-after-free (CWE-416) in Microsoft Edge, which is built on the open-source Chromium engine; the 'Google' tag indicates the defect likely originates in shared Chromium/Blink code that Microsoft rebases into Edge. A use-after-free occurs when the browser continues to reference heap memory after it has been freed, letting an attacker groom the heap so the dangling pointer resolves to attacker-controlled data, which can corrupt object state and redirect control flow. The affected CPE is cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*, covering the modern Chromium-based Edge desktop browser rather than the legacy EdgeHTML product.

RemediationAI

Patch available per vendor advisory: update Microsoft Edge to the latest patched build published in Microsoft's Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57986, which for Chromium-based Edge is delivered through the browser's automatic update channel (verify via edge://settings/help). Because Edge auto-updates, the primary action is to ensure the update service is not disabled and to restart the browser so the new build loads; in managed environments push the corresponding channel update via your update management tooling and confirm the deployed build meets or exceeds Microsoft's fixed version. As an interim compensating control before patching, restrict exposure to untrusted web content - for example enforce Enhanced Security Mode / strict site isolation and limit high-risk browsing - accepting the trade-off of some site compatibility and usability friction; this reduces but does not eliminate risk because the flaw lives in the rendering engine itself.