EUVD-2026-41589
GHSA-mm5h-w49f-qxp5
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via web content (AV:N) with no attacker auth (PR:N) but mandatory victim interaction (UI:R) and non-trivial conditions (AC:H); RCE yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 lets an unauthorized attacker run arbitrary code when a victim is lured to interact with attacker-controlled content, stemming from external control of a file name or path (CWE-73). The flaw is network-reachable but non-trivial to exploit, requiring user interaction and high attack complexity, and there is no public exploit identified at time of analysis. Microsoft has released a patched build, and EPSS estimates a low 0.53% exploitation probability with SSVC reporting no observed exploitation.
Technical ContextAI
The affected product is the Chromium-based Microsoft Edge browser (CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based)), Microsoft's mainstream browser built atop the open-source Chromium engine. The root cause is classified as CWE-73, External Control of File Name or Path, meaning the browser uses externally supplied input to construct a file name or path without adequate validation. In a browser context this typically allows a remote page to influence which file resource is referenced, opened, or written, and in this case the mishandling is severe enough to yield code execution rather than mere information disclosure. The vulnerability sits in Edge-specific code or its integration layer with Chromium rather than a purely upstream Chromium defect, given Microsoft is the reporting/patching vendor.
RemediationAI
Vendor-released patch: update Microsoft Edge to version 150.0.4078.48 or later, which is the first fixed build per the EUVD data and Microsoft's MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58293. Because Edge auto-updates by default, ensure the browser's update mechanism is not disabled by policy and force a restart of the browser so the new build takes effect; in managed environments push the update via your standard patch/GPO/Intune channel and verify the reported version reaches 150.0.4078.48. As interim compensating controls until patching, restrict users from visiting untrusted sites (SmartScreen/URL filtering), since exploitation requires user interaction with attacker content, and consider enforcing Edge's enhanced security/site-isolation modes; these reduce exposure but do not remove the flaw and may affect compatibility with some legacy sites, so patching remains the definitive fix.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today