What is the CVSS score of CVE-2026-58285?

CVE-2026-58285 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Edge are affected by CVE-2026-58285?

Microsoft Edge deployments across the organization are vulnerable to remote code execution attacks (CVE-2026-58285, CVSS 8.3) triggered by user visits to attacker-controlled web content.. A patch is available.

How to fix or mitigate CVE-2026-58285?

Within 24 hours: Distribute user communication highlighting the vulnerability and directing users to apply browser updates and avoid untrusted websites. Within 7 days: Deploy Microsoft MSRC security patches for Microsoft Edge to all managed systems via Windows Update, WSUS, or organizational patch management tools. Within 30 days: Confirm deployment coverage of at least 99% of vulnerable Edge installations through asset inventory and audit systems that remain unpatched.

Microsoft Edge CVE-2026-58285

EUVD-2026-41583 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-07-03 microsoft

GHSA-4prc-gc25-x2h7

Memory Corruption Authentication Bypass Microsoft Google Microsoft Edge Chromium Based

8.3

CVSS 3.1 · Vendor: microsoft

Temporal: 7.2

Severity by source

Vendor (microsoft) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

CIRCL (temporal)

7.2 HIGH

cvss

vuln.today AI

8.3 HIGH

Network-delivered browser RCE needing the user to open malicious content (UI:R) with unreliable memory-state prerequisites (AC:H), no auth (PR:N), and a sandbox/process crossing (S:C) giving full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:49 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 8.3

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) via a type-confusion flaw (CWE-843) lets an unauthorized attacker run arbitrary code when a victim is lured to malicious web content. The CVSS 3.1 base score is 8.3 with a scope change, reflecting a likely renderer-to-sandbox impact, but exploitation requires user interaction and has high attack complexity. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host malicious web page with crafted JS

Delivery

Lure victim to open page in Edge

Exploit

Trigger type confusion in JS engine

Execution

Corrupt memory and gain primitive

Impact

Execute arbitrary code in browser context

Access

Host malicious web page with crafted JS

Delivery

Lure victim to open page in Edge

Exploit

Trigger type confusion in JS engine

Execution

Corrupt memory and gain primitive

Impact

Execute arbitrary code in browser context

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to actively load attacker-controlled web content in Microsoft Edge (Chromium-based) - the CVSS UI:R metric confirms user interaction is mandatory, so this is not a zero-click bug. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, score 8.3) describes a network-reachable, unauthenticated bug with full confidentiality/integrity/availability impact and a scope change consistent with a sandbox or process boundary crossing, but two mitigating metrics - AC:H (high complexity, e.g. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page containing crafted JavaScript that triggers the type-confusion condition in Edge's rendering/JS engine, then emails or otherwise lures a target into opening it. When the victim visits the page and the exploit succeeds, memory corruption is leveraged to execute attacker code in the browser context; the high attack complexity means a reliable exploit likely requires precise heap manipulation, and no public POC is currently known.
Remediation	Patch available per vendor advisory: update Microsoft Edge to the fixed Stable-channel build listed in Microsoft's Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58285 (the exact fixed version is not provided in the input and should be read from that advisory). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Distribute user communication highlighting the vulnerability and directing users to apply browser updates and avoid untrusted websites. …

Threat intelligence, references, and detailed analysis are available after sign-in.