EUVD-2026-41571
GHSA-7xpx-9crg-rx5q
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 03, 2026
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthorized attacker to run arbitrary code when a victim views attacker-controlled web content, stemming from a use-after-free memory-corruption flaw (CWE-416). The scope-changed CVSS vector (S:C) indicates the bug can breach the browser's sandbox boundary. Microsoft has released a fix; there is no public exploit identified at time of analysis (CVSS E:U) and it is not listed in CISA KEV.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Microsoft Edge Chromium Based gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A remote code execution vulnerability in Microsoft Edge allows attackers to execute arbitrary code on user systems when employees view attacker-controlled websites, potentially bypassing browser protections to gain full system access. This threatens any organization where employees use Microsoft Edge, creating risk of data theft, malware installation, and lateral network movement. Immediate patching is critical to prevent targeted exploitation.
Within 24 hours: Inventory and assess the extent of Microsoft Edge deployments across the organization. Within 7 days: Deploy Microsoft's vendor-released patch to all Microsoft Edge installations (verify exact patched version from Microsoft Security Update Guide and test in controlled environment before broad rollout). Within 30 days: Confirm 100% patch compliance across all systems and document remediation in security tracking system.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) lets an attacker run arbitrary code in the browser by getting a
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Use-after-free memory corruption in Microsoft Edge (Chromium-based) can let remote attackers execute arbitrary code in t
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Exploit-DB