EUVD-2026-41586
GHSA-39f3-ggrp-rph3
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered malicious page (AV:N) needing user visit (UI:R) and a non-trivial reliable trigger (AC:H); no auth (PR:N); sandbox-crossing type confusion yields total impact (S:C, C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run arbitrary code when a victim is lured to a malicious web page, via a type-confusion flaw (CWE-843) in the browser engine. The CVSS:3.1 score is 8.3 with a scope change (S:C), indicating a likely sandbox/renderer boundary escape, though exploitation carries high attack complexity and requires user interaction. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none, with EPSS at 0.53% (41st percentile).
Technical ContextAI
The affected component is the Chromium-based rendering/JavaScript engine underlying Microsoft Edge (CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based)). CWE-843 (Access of Resource Using Incompatible Type, 'type confusion') occurs when code interprets a memory object as a different type than it was allocated as - commonly in V8's JIT-optimized JavaScript execution - allowing an attacker to violate type-safety assumptions and gain control over memory layout. The 'Google' tag and Chromium lineage suggest this is an upstream Chromium/V8 memory-corruption issue inherited by Edge; the CVSS scope change (S:C) is consistent with a renderer-process bug that crosses the browser sandbox boundary. Type-confusion bugs are a classic path to controlled read/write primitives and ultimately code execution.
RemediationAI
Vendor-released patch: update Microsoft Edge (Chromium-based) to version 150.0.4078.48 or later, as published in Microsoft's MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58289). Edge updates automatically for most users, so verify the installed build via edge://settings/help and force an update where auto-update is disabled or managed by policy; in enterprise environments push the fixed build through your update management channel. If patching must be delayed, reduce exposure by restricting browsing to trusted sites, enabling Enhanced Security Mode / site isolation, and using web-content filtering or proxy controls to block access to untrusted external sites - the trade-off is reduced usability and potential breakage of legitimate sites that rely on JIT-heavy JavaScript. These are only stopgaps; because the flaw is triggered by rendering malicious web content, upgrading to 150.0.4078.48 is the definitive fix.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Privilege elevation in Microsoft Edge (Chromium-based) lets a network attacker escalate privileges by luring a victim in
Same technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today