What is the CVSS score of CVE-2026-58287?

CVE-2026-58287 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Edge Chromium Based are affected by CVE-2026-58287?

A remote code execution vulnerability in Microsoft Edge allows attackers to execute arbitrary code on user systems when employees view attacker-controlled websites, potentially bypassing browser…. A patch is available.

How to fix or mitigate CVE-2026-58287?

Within 24 hours: Inventory and assess the extent of Microsoft Edge deployments across the organization. Within 7 days: Deploy Microsoft's vendor-released patch to all Microsoft Edge installations (verify exact patched version from Microsoft Security Update Guide and test in controlled environment before broad rollout). Within 30 days: Confirm 100% patch compliance across all systems and document remediation in security tracking system.

Microsoft Edge Chromium Based CVE-2026-58287

EUVD-2026-41571 HIGH

Use After Free (CWE-416)

2026-07-03 microsoft

GHSA-7xpx-9crg-rx5q

Memory Corruption Google Microsoft Denial Of Service Use After Free Microsoft Edge Chromium Based

8.3

CVSS 3.1 · Vendor: microsoft

Temporal: 7.2

Severity by source

Vendor (microsoft) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

CIRCL (temporal)

7.2 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:20 vuln.today

CVE Published

Jul 03, 2026 - 20:35 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) allows an unauthorized attacker to run arbitrary code when a victim views attacker-controlled web content, stemming from a use-after-free memory-corruption flaw (CWE-416). The scope-changed CVSS vector (S:C) indicates the bug can breach the browser's sandbox boundary. Microsoft has released a fix; there is no public exploit identified at time of analysis (CVSS E:U) and it is not listed in CISA KEV.