EUVD-2026-41570
GHSA-9h2j-pmwx-xhhx
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N
Browser flaw requires victim to render attacker content (UI:R) and precise engine grooming (AC:H); spoofing is an integrity-only impact (I:H, C/A:N), with no cross-component scope change.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Spoofing in Microsoft Edge (Chromium-based) stems from a type-confusion memory-safety defect (CWE-843) that a remote, unauthenticated attacker can leverage over the network to misrepresent content or origin to the victim. Microsoft rates it CVSS 8.1 with a changed scope, driven largely by high integrity impact, though the CVSS vector's high attack complexity (AC:H) signals non-trivial exploitation. There is no public exploit identified at time of analysis (CVSS E:U), and it is not listed in CISA KEV; Microsoft has already shipped an official fix (RL:O).
Technical ContextAI
The affected component is Microsoft Edge built on the Chromium engine (cpe:2.3:a:microsoft:microsoft_edge_(chromium-based)), meaning the root cause almost certainly lives in a shared Chromium/V8/Blink subsystem rather than Microsoft-unique code. CWE-843 (Access of Resource Using Incompatible Type, or 'type confusion') occurs when code interprets a memory object as one type while it was allocated or initialized as another; in JavaScript/DOM engines this typically arises from optimizer or object-shape assumptions that a crafted script can violate. While type confusion is a classic path to memory corruption and code execution, Microsoft characterizes the security outcome here as spoofing with high integrity but only low confidentiality and low availability impact, suggesting the confusion is exploited to falsify what the browser presents (e.g., origin/UI/content) rather than to achieve full RCE.
RemediationAI
Patch available per vendor advisory: update Microsoft Edge to the fixed Stable-channel build published by Microsoft - see https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58283 for the exact version (an explicit fixed version number was not included in the provided input, so confirm it in the advisory before asserting it). Because Edge auto-updates by default, ensure automatic updates are enabled and force a restart to apply the update; in managed fleets, push the update via your patch-management/Group Policy (Edge Update) tooling rather than relying on user restarts. As an interim compensating control until patching completes, restrict use of Edge for browsing untrusted sites (steer users to an already-patched browser), and consider enforcing Edge's Enhanced Security Mode / site isolation to raise the bar for memory-safety exploitation - the trade-off is potential minor performance and compatibility impact on legacy sites.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run
Same technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today