What is the CVSS score of CVE-2026-58285?

CVE-2026-58285 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Edge are affected by CVE-2026-58285?

Microsoft Edge deployments across the organization are vulnerable to remote code execution attacks (CVE-2026-58285, CVSS 8.3) triggered by user visits to attacker-controlled web content.. A patch is available.

How to fix or mitigate CVE-2026-58285?

Within 24 hours: Distribute user communication highlighting the vulnerability and directing users to apply browser updates and avoid untrusted websites. Within 7 days: Deploy Microsoft MSRC security patches for Microsoft Edge to all managed systems via Windows Update, WSUS, or organizational patch management tools. Within 30 days: Confirm deployment coverage of at least 99% of vulnerable Edge installations through asset inventory and audit systems that remain unpatched.

Microsoft Edge CVE-2026-58285

EUVD-2026-41583 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-07-03 microsoft

GHSA-4prc-gc25-x2h7

Memory Corruption Authentication Bypass Microsoft Google Microsoft Edge Chromium Based

8.3

CVSS 3.1 · Vendor: microsoft

Temporal: 7.2

Severity by source

Vendor (microsoft) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

CIRCL (temporal)

7.2 HIGH

cvss

vuln.today AI

8.3 HIGH

Network-delivered browser RCE needing the user to open malicious content (UI:R) with unreliable memory-state prerequisites (AC:H), no auth (PR:N), and a sandbox/process crossing (S:C) giving full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:49 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 8.3

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) via a type-confusion flaw (CWE-843) lets an unauthorized attacker run arbitrary code when a victim is lured to malicious web content. The CVSS 3.1 base score is 8.3 with a scope change, reflecting a likely renderer-to-sandbox impact, but exploitation requires user interaction and has high attack complexity. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available via Microsoft's MSRC update guide.

Technical ContextAI

Microsoft Edge (Chromium-based) shares the Blink rendering engine and V8 JavaScript engine with upstream Chromium, so memory-safety defects in that shared code frequently surface in Edge. CWE-843 (Access of Resource Using Incompatible Type, 'type confusion') occurs when code allocates or interprets an object as one type but later accesses it as an incompatible type - a classic pattern in JIT-compiled JavaScript engines like V8 where an object's shape assumptions can be violated. Such confusion produces a memory-corruption primitive (the 'Memory Corruption' tag and 'Google'/Chromium tags corroborate the shared-engine origin) that skilled attackers convert into controlled reads/writes and ultimately code execution. The single affected CPE is cpe:2.3:a:microsoft:microsoft_edge_(chromium-based), i.e. the desktop Chromium-based Edge browser rather than legacy EdgeHTML.

RemediationAI

Patch available per vendor advisory: update Microsoft Edge to the fixed Stable-channel build listed in Microsoft's Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58285 (the exact fixed version is not provided in the input and should be read from that advisory). Because Edge auto-updates, ensure the browser has been fully restarted to apply the update and verify the running version via edge://settings/help; in managed environments push the update through your standard channel (WSUS/Intune/SCCM) and confirm the browser AutoUpdate policy is not disabled. If immediate patching is not possible, reduce exposure by restricting browsing to trusted sites, enabling Enhanced Security Mode (which disables/relaxes JIT and adds hardening for untrusted sites, at some performance and compatibility cost), and using network/web filtering to block untrusted domains - none of these fully eliminate the type-confusion risk, so patching remains the only complete fix.