What is the CVSS score of CVE-2026-58276?

CVE-2026-58276 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Edge are affected by CVE-2026-58276?

Microsoft Edge contains a remote code execution vulnerability (CVE-2026-58276) that could allow attackers to execute arbitrary code on user systems through malicious or compromised web content.. A patch is available.

How to fix or mitigate CVE-2026-58276?

24 hours: Obtain the latest Microsoft Edge patch version addressing CVE-2026-58276 and validate compatibility with organizational deployments. 7 days: Deploy the patch to representative test systems and communicate the mandatory patch timeline to all end users. 30 days: Complete deployment of the patched version across all organizational Microsoft Edge installations; verify completion through endpoint management tools.

Microsoft Edge CVE-2026-58276

EUVD-2026-41580 HIGH

Use After Free (CWE-416)

2026-07-03 microsoft

GHSA-vw2p-73gr-hwh5

Denial Of Service Google Use After Free Memory Corruption Microsoft Microsoft Edge Chromium Based

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.5 MEDIUM

cvss

vuln.today AI

7.5 HIGH

Network-delivered web content (AV:N) needing victim navigation (UI:R) and difficult heap grooming/race for a UAF (AC:H); no auth (PR:N); code execution yields full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:30 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) that an unauthorized network attacker can trigger to run arbitrary code in the browser process. Exploitation requires the victim to interact with attacker-controlled content (UI:R) and involves high attack complexity (AC:H), so a user must be lured to a malicious or compromised page. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; Microsoft has released a fix.

Technical ContextAI

The affected component is Microsoft Edge built on the Chromium open-source engine (cpe:2.3:a:microsoft:microsoft_edge_(chromium-based)), so the root cause lies in the shared Blink/V8/Chromium codebase that Edge inherits and Microsoft repackages. CWE-416 (Use After Free) means the browser continues to reference a heap object after it has been freed; an attacker who can control heap allocation and reuse timing can place attacker-chosen data in the freed slot, corrupting memory and steering execution. The 'Google' and 'Denial Of Service' tags indicate this originates upstream from Chromium (Google) and that the same dangling-pointer condition can also crash the renderer, but the assessed impact here is full code execution.

RemediationAI

Patch available per vendor advisory: update Microsoft Edge to the fixed Chromium-based build described at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58276 by ensuring Edge auto-update is enabled (edge://settings/help forces an update check) or by pushing the current channel build through your management tooling. Because Edge inherits Chromium fixes, confirm the deployed build number meets or exceeds the version Microsoft lists rather than relying on the CVE ID alone. If immediate patching is not possible, reduce exposure by restricting browsing to trusted sites, deploying Edge in an isolated or sandboxed profile, and using Microsoft Defender Application Guard / SmartScreen to blunt drive-by delivery - with the trade-off that these controls add management overhead and can affect user experience but do not remove the underlying use-after-free.