EUVD-2026-43191Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered but needs victim interaction (UI:R) and difficult-to-control conditions (AC:H); no auth (PR:N); deserialization RCE with sandbox escape yields S:C and full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by luring a victim into interacting with crafted content that triggers unsafe deserialization (CWE-502). The flaw carries CVSS 8.3 with a scope change, meaning successful exploitation can break out of the browser's security boundary, though there is no public exploit identified at time of analysis and Microsoft has already shipped a fix.
Technical ContextAI
The affected product is the Chromium-based Microsoft Edge browser (cpe:2.3:a:microsoft:microsoft_edge_(chromium-based)). The root cause is CWE-502, Deserialization of Untrusted Data: the browser reconstructs objects from attacker-influenced serialized data without adequately validating type or content, allowing an adversary to smuggle a malicious object graph that executes code during or after deserialization. In a browser context this typically means attacker-controlled web content is parsed into internal object structures, and the CVSS scope change (S:C) indicates the impact reaches beyond the initially vulnerable component - consistent with escaping the renderer sandbox into a more privileged context.
RemediationAI
Patch available per vendor advisory - update Microsoft Edge (Chromium-based) to the latest Stable channel build via the browser's built-in updater (edge://settings/help) or enterprise update management, per Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58281; the exact fixed version is not provided in the input and should be confirmed from that advisory. Because exploitation requires user interaction with malicious content, interim compensating controls include enforcing prompt browser auto-updates, restricting users from browsing untrusted sites, and enabling network/web filtering to block known-malicious pages - with the trade-off that these reduce but do not eliminate exposure and may affect legitimate browsing. Ensure Edge's sandbox and site isolation protections remain enabled, since the scope-change impact suggests a sandbox-boundary escape.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run
Privilege elevation in Microsoft Edge (Chromium-based) lets a network attacker escalate privileges by luring a victim in
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today