What is the CVSS score of CVE-2026-58276?

CVE-2026-58276 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Edge are affected by CVE-2026-58276?

Microsoft Edge contains a remote code execution vulnerability (CVE-2026-58276) that could allow attackers to execute arbitrary code on user systems through malicious or compromised web content.. A patch is available.

How to fix or mitigate CVE-2026-58276?

24 hours: Obtain the latest Microsoft Edge patch version addressing CVE-2026-58276 and validate compatibility with organizational deployments. 7 days: Deploy the patch to representative test systems and communicate the mandatory patch timeline to all end users. 30 days: Complete deployment of the patched version across all organizational Microsoft Edge installations; verify completion through endpoint management tools.

Microsoft Edge CVE-2026-58276

EUVD-2026-41580 HIGH

Use After Free (CWE-416)

2026-07-03 microsoft

GHSA-vw2p-73gr-hwh5

Memory Corruption Google Microsoft Denial Of Service Use After Free Microsoft Edge Chromium Based

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.5 MEDIUM

cvss

vuln.today AI

7.5 HIGH

Network-delivered web content (AV:N) needing victim navigation (UI:R) and difficult heap grooming/race for a UAF (AC:H); no auth (PR:N); code execution yields full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:30 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) that an unauthorized network attacker can trigger to run arbitrary code in the browser process. Exploitation requires the victim to interact with attacker-controlled content (UI:R) and involves high attack complexity (AC:H), so a user must be lured to a malicious or compromised page. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Lure victim to malicious page

Delivery

Deliver crafted JS/DOM payload

Exploit

Trigger use-after-free in Edge

Execution

Reuse freed heap object

Impact

Execute arbitrary code in browser

Access

Lure victim to malicious page

Delivery

Deliver crafted JS/DOM payload

Exploit

Trigger use-after-free in Edge

Execution

Reuse freed heap object

Impact

Execute arbitrary code in browser

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to actively open or interact with attacker-controlled web content in Microsoft Edge (CVSS UI:R), so it cannot be triggered silently server-side; no authentication is needed (PR:N), meaning any user who is socially engineered to a malicious page is at risk. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are moderate and internally consistent rather than alarming. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page containing crafted JavaScript/DOM content that grooms the heap and triggers the dangling pointer, then lures a victim to visit it via phishing, malvertising, or a compromised site. When the victim's Edge browser renders the page, the use-after-free is triggered and attacker-supplied data is executed as code within the browser process. …
Remediation	Patch available per vendor advisory: update Microsoft Edge to the fixed Chromium-based build described at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58276 by ensuring Edge auto-update is enabled (edge://settings/help forces an update check) or by pushing the current channel build through your management tooling. … Detailed patch versions, workarounds, and compensating controls in full report.