What is the CVSS score of CVE-2026-66315?

CVE-2026-66315 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Microsoft Edge are affected by CVE-2026-66315?

Microsoft Edge contains a critical remote code execution vulnerability (CVE-2026-66315) that enables unauthenticated attackers to execute arbitrary code on user systems through crafted web content…. A patch is available.

How to fix or mitigate CVE-2026-66315?

Within 24 hours, inventory all Microsoft Edge deployments and create a patch deployment timeline prioritizing systems handling sensitive data or critical business functions. Within 7 days, apply the vendor-released patch to all affected instances across your organization, validating the update on a representative sample before full rollout. Within 30 days, complete deployment verification on 100% of systems and audit access logs from the patching window for exploitation attempts; note that no public exploit identified at time of analysis.

Microsoft Edge CVE-2026-66315

EUVD-2026-52527 HIGH

Use After Free (CWE-416)

2026-08-03 microsoft

GHSA-67mx-4qr8-qq4c

Use After Free Microsoft Google Denial Of Service Memory Corruption Microsoft Edge Chromium Based

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.5 MEDIUM

cvss

vuln.today AI

7.5 HIGH

Use-after-free via web content requires high-complexity memory manipulation and user interaction; no privileges needed; full C/I/A impact from code execution; scope unchanged to Edge process.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 00:07 vuln.today

CVE Published

Aug 03, 2026 - 22:53 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) is possible via a use-after-free memory corruption flaw exploitable over a network by an unauthenticated attacker who can induce user interaction with malicious content. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full impact potential against confidentiality, integrity, and availability, tempered by high attack complexity and mandatory user interaction. No public exploit identified at time of analysis and the temporal metric E:U (Unproven) aligns with this; a vendor-released patch is confirmed available via the Microsoft Security Response Center.

Technical ContextAI

CWE-416 (Use After Free) describes a class of memory safety flaw in which a program continues referencing a pointer after the associated memory block has been freed; if an attacker can control what data is placed in the reclaimed region, they can redirect execution flow or corrupt program state. The affected product per CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:* is the Chromium-based variant of Microsoft Edge - Microsoft's browser built atop the open-source Chromium rendering engine. Use-after-free vulnerabilities are endemic to complex C++ rendering engines due to intricate object lifecycle management during DOM manipulation, JavaScript execution, layout processing, and media decoding. Tags confirm memory corruption and denial-of-service as additional side-effect impact classes alongside code execution. The wildcard CPE version field indicates NVD has not bounded the affected version range in CPE data.

RemediationAI

Apply the vendor-released patch for Microsoft Edge (Chromium-based) as documented in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66315; the exact patched version number must be confirmed from that advisory, as it was not independently specified in the source data. Microsoft Edge supports automatic background updates - verify the installed version matches the fixed release listed in the MSRC advisory via edge://settings/help. As an interim compensating control, instruct users to avoid visiting untrusted or unsolicited URLs, which directly addresses the UI:R prerequisite and reduces the attacker's ability to trigger the flaw; the trade-off is limited operational impact since browsing behavior is not enforced. In high-sensitivity environments where patching cannot be immediately applied, restricting or disabling Microsoft Edge in favor of an alternative patched browser is a viable temporary measure with the trade-off of workflow disruption.