What is the CVSS score of CVE-2026-58292?

CVE-2026-58292 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Edge are affected by CVE-2026-58292?

Microsoft Edge (Chromium-based) contains a remote code execution vulnerability (CVE-2026-58292) that allows unauthenticated attackers to execute arbitrary code on user systems through malicious web…. A patch is available.

How to fix or mitigate CVE-2026-58292?

Within 24 hours: Identify all Microsoft Edge deployments and assess user exposure; notify stakeholders of the vulnerability. Within 7 days: Deploy Microsoft's released patch to all Edge instances through standard update mechanisms (enable automatic updates where possible). Within 30 days: Verify 100% patch deployment via MDM/SCCM and conduct vulnerability scans to confirm complete remediation.

Microsoft Edge CVE-2026-58292

EUVD-2026-41588 HIGH

Improper Input Validation (CWE-20)

2026-07-03 microsoft

GHSA-rp87-gqr5-74pm

Authentication Bypass Microsoft Google Microsoft Edge Chromium Based

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L

CIRCL (temporal)

6.5 MEDIUM

cvss

vuln.today AI

7.5 HIGH

Network browser flaw needing a lured user (UI:R) under hard-to-control conditions (AC:H), no auth (PR:N), with a renderer-to-host sandbox escape (S:C) yielding code execution.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:42 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated attacker run code on a victim's machine when the user is lured into interacting with attacker-controlled web content. The flaw stems from improper input validation (CWE-20) and, per its CVSS scope-change metric, is consistent with a renderer/sandbox boundary escape. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has released a fix.

Technical ContextAI

Microsoft Edge (Chromium-based) is Microsoft's browser built on the open-source Chromium engine that also underpins Google Chrome, which is why the intelligence tags reference both Google and Microsoft - a defect in shared Chromium code frequently affects both browsers. The root cause is CWE-20 (Improper Input Validation): a component fails to correctly validate untrusted input (typically web page data, a URL, script, or a parsed resource) before acting on it. The CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:* confirms the affected product is the Chromium-based Edge application across unspecified versions. The CVSS scope-change flag (S:C) indicates the impact crosses the security authority that contains the vulnerable component, which for a browser is the classic pattern of code in the sandboxed renderer affecting the wider host.

RemediationAI

Update Microsoft Edge to the fixed build referenced in Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58292; a patch is available per vendor advisory, though an exact fixed version number is not provided in the input data and should be read directly from that MSRC page. In managed environments, ensure Edge automatic updates are enabled and force-restart the browser so the update installs, or push the update through your endpoint management tooling. As an interim compensating control, restrict users from browsing untrusted or attacker-controlled sites (the vulnerability requires user interaction), and where feasible steer high-risk browsing to an alternate updated browser until Edge is patched; note the trade-off that browser-steering and site-blocking add user friction and are not a substitute for the update. Because this affects Chromium, also verify that other Chromium-based browsers in the environment are patched.