What is the CVSS score of CVE-2026-58290?

CVE-2026-58290 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Edge Chromium Based are affected by CVE-2026-58290?

Microsoft Edge users across the organization face remote code execution risk from CVE-2026-58290 when visiting adversary-controlled websites.. A patch is available.

How to fix or mitigate CVE-2026-58290?

Within 24 hours: Distribute security alert identifying all Microsoft Edge users and directing them to available patches via Microsoft Security Update Guide. Within 7 days: Deploy the available Microsoft Edge patch through your patch management system to all managed endpoints. Within 30 days: Verify patch deployment across the estate with completion metrics reported to security leadership.

Microsoft Edge Chromium Based CVE-2026-58290

EUVD-2026-41587 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-07-03 microsoft

GHSA-wrqp-3qp3-gqcj

Authentication Bypass Google Memory Corruption Microsoft Microsoft Edge Chromium Based

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L

CIRCL (temporal)

6.5 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:43 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) stems from a type confusion flaw (CWE-843) that an unauthorized attacker can trigger over the network to run arbitrary code, provided the victim interacts with attacker-controlled web content. Microsoft self-reported and has shipped a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The high attack complexity (AC:H) and required user interaction (UI:R) temper an otherwise network-reachable, unauthenticated attack surface.