EUVD-2026-41591
GHSA-jjfj-r463-g4c7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Network-delivered browser bug needs the victim to load malicious content, so UI:R; PR:N and scope change (S:C) for the security-boundary bypass, with low CIA impact matching a feature bypass.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
AnalysisAI
Security-feature bypass in Microsoft Edge (Chromium-based) stems from a type-confusion (CWE-843) flaw that a remote, unauthenticated attacker can trigger over the network to defeat a browser security boundary. Microsoft has published a fix via its Update Guide (CVE-2026-58295), and the issue carries a CVSS 8.3 with a scope change reflecting the crossed trust boundary. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Technical ContextAI
The affected component is Microsoft Edge built on the Chromium engine (cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*). CWE-843, 'Access of resource using incompatible type (type confusion),' occurs when code interprets a memory object as a different type than it was allocated as - commonly in the JavaScript/V8 engine or Blink, where an object's assumed type diverges from its actual layout. This lets an attacker manipulate pointers or fields the browser trusts, and here the corruption is leveraged to bypass a security feature rather than to achieve full memory-corruption code execution. The 'Google' and 'Memory Corruption' tags indicate the root cause likely lives in shared upstream Chromium code that Edge inherits.
RemediationAI
Patch available per vendor advisory - update Microsoft Edge to the latest Stable channel build referenced in Microsoft's Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58295 (Edge auto-updates, but force it via edge://settings/help or enterprise update tooling to confirm the patched version is deployed). No exact fixed version number was supplied in the input, so confirm the target build directly from the advisory before validating remediation. As an interim compensating control where patching is delayed, restrict browsing to trusted sites via enterprise policy and enable/verify Microsoft Defender SmartScreen and Enhanced Security Mode (which throttles JIT and applies extra hardening to untrusted sites), accepting that Enhanced Security Mode can degrade performance and break some script-heavy internal applications.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execu
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today