What is the CVSS score of CVE-2026-58294?

CVE-2026-58294 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Edge are affected by CVE-2026-58294?

Microsoft Edge contains a remote code execution vulnerability (CVE-2026-58294) that allows unauthenticated attackers to compromise endpoints when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-58294?

Within 24 hours: Inventory all Microsoft Edge deployments and notify IT and end users of patch availability. Within 7 days: Deploy the Microsoft Edge security patch for CVE-2026-58294 to all organizational endpoints (consult Microsoft Security Update Guide for specific version details). Within 30 days: Confirm patch deployment completion across all systems and implement browser security policies such as restricted website access controls.

Microsoft Edge CVE-2026-58294

EUVD-2026-41590 HIGH

Use After Free (CWE-416)

2026-07-03 microsoft

GHSA-qqhm-6qqw-68j4

Memory Corruption Google Microsoft Denial Of Service Use After Free Microsoft Edge Chromium Based

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.5 MEDIUM

cvss

vuln.today AI

7.5 HIGH

Remote unauthenticated (AV:N/PR:N) but requires the victim to load malicious content (UI:R) and win a UAF race (AC:H); full RCE gives C/I/A:H with scope unchanged absent a confirmed sandbox escape.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:39 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw that an unauthorized, remote attacker can trigger to run arbitrary code. Exploitation requires the victim to interact with attacker-controlled web content, and the CVSS 3.1 vector marks high attack complexity (AC:H) despite requiring no privileges (PR:N). Microsoft has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

Microsoft Edge (Chromium-based) is built on the open-source Chromium/Blink engine, so its rendering, JavaScript (V8), and browser subsystems share the same codebase and memory-management model as Google Chrome - reflected here by the 'Google' tag alongside the Microsoft attribution. The root cause is a use-after-free (CWE-416): an object is freed while a dangling pointer to it remains reachable, and subsequent dereference or reallocation of that freed memory lets an attacker corrupt heap state and hijack control flow. In browser engines, such UAF bugs are typically reached through crafted HTML/JavaScript/DOM manipulation that races object lifetimes within the renderer process. The affected product per CPE is cpe:2.3:a:microsoft:microsoft_edge_(chromium-based), i.e., the desktop Chromium-based Edge browser.

RemediationAI

Patch available per vendor advisory: update Microsoft Edge (Chromium-based) to the fixed build published by Microsoft at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58294; the exact patched version is not provided in the input data and should be confirmed from that advisory. Edge normally auto-updates, so ensure automatic updates are enabled and force a restart of the browser to apply the fix, and in managed environments push the update via your patch-management or Microsoft update channel (WSUS/Intune/SCCM) and verify the deployed build. As an interim compensating control while patching, because exploitation requires the user to load malicious web content you can reduce exposure by restricting browsing to trusted sites, enabling Microsoft Defender SmartScreen and Enhanced Security Mode (which disables JIT and adds mitigations at a performance and compatibility cost), and using web-proxy/URL filtering to block untrusted destinations - these reduce but do not eliminate risk and should not replace applying the patch.