What is the CVSS score of CVE-2026-57992?

CVE-2026-57992 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Edge are affected by CVE-2026-57992?

Microsoft Edge contains a remote code execution vulnerability (CVE-2026-57992, CVSS 7.5) that allows attackers to seize control of user systems when victims visit attacker-controlled websites.. A patch is available.

How to fix or mitigate CVE-2026-57992?

Within 24 hours: Inventory all Microsoft Edge installations across the enterprise and establish a testing/deployment timeline. Within 7 days: Deploy the latest patched version of Microsoft Edge to all user endpoints and corporate systems. Within 30 days: Validate patch compliance across the organization, monitor endpoint telemetry for exploitation attempts, and document remediation status.

Microsoft Edge CVE-2026-57992

EUVD-2026-41566 HIGH

Use After Free (CWE-416)

2026-07-03 microsoft

GHSA-pwgr-7g5c-fjgv

Memory Corruption Google Microsoft Denial Of Service Use After Free Microsoft Edge Chromium Based

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.5 MEDIUM

cvss

vuln.today AI

7.5 HIGH

Network-delivered browser UAF needing victim navigation (UI:R) and complex heap grooming (AC:H); no privileges (PR:N), renderer-scoped (S:U) with full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:14 vuln.today

CVE Published

Jul 03, 2026 - 20:35 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated attacker run arbitrary code when a victim is lured into loading attacker-controlled web content that triggers a use-after-free memory corruption. The flaw carries a CVSS 3.1 base of 7.5 and requires user interaction, and the CVSS temporal metrics (E:U, RL:O, RC:C) indicate the issue is confirmed and officially patched with no public exploit identified at time of analysis. Because Edge shares Chromium's rendering engine, the underlying defect is likely rooted in an upstream Chromium/Blink component (the intel tags also reference Google).

Technical ContextAI

The vulnerability is a use-after-free (CWE-416): a pointer to a heap object continues to be referenced after that object has been freed, allowing an attacker who can control heap reuse to redirect execution or corrupt memory. It resides in Microsoft Edge (Chromium-based), a Blink/V8-derived browser that inherits Google Chromium's rendering, JavaScript, and DOM subsystems - the 'Google' tag in the intelligence suggests the root cause may originate in shared upstream Chromium code rather than Microsoft-specific additions. The affected product is identified by CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:* with no bounded version range supplied, so all pre-patch builds should be presumed vulnerable. Use-after-free bugs in browser engines are a classic path to sandboxed renderer compromise and are frequently chained with a sandbox-escape bug for full system code execution.

RemediationAI

Patch available per vendor advisory: update Microsoft Edge to the latest Stable channel build referenced in Microsoft's Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57992 (an exact fixed version number was not provided in the input and should be taken from that advisory). Because Edge auto-updates by default, ensure the browser is fully restarted after update so the new binary loads, and in managed environments confirm that update policies or the 'Edge Update' service are not disabled. As an interim compensating control before patching, restrict exposure by advising users to avoid untrusted sites, enabling Enhanced Security Mode / strict site isolation, and deploying web/DNS filtering to block malicious content delivery - with the trade-off that these reduce but do not eliminate exposure since the attack rides on ordinary web navigation.