EUVD-2026-67851
GHSA-c27v-65fh-7pg2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted malicious webpage
-
ExploitVictim navigates to page in unpatched Edge
-
ExecutionPage content triggers use-after-free in Chromium memory subsystem
-
ImpactEdge tab or process crashes (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | User interaction is required - the victim must navigate to or be redirected to attacker-controlled web content in Microsoft Edge (Chromium-based), as specified by UI:R in the CVSS vector. The attack is network-reachable (AV:N) and requires no authentication or prior privileges (PR:N). Limiting factors are significant: (1) a user must actively browse to the malicious page, eliminating fully passive network-level exploitation; (2) impact is restricted to low availability disruption (A:L) - no confidentiality or integrity compromise - contradicting the description's code execution claim, which is unverified; (3) scope is unchanged (S:U), confining impact to the browser process with no OS-level escalation. Exploitation provides no persistent foothold and no data access, sharply limiting attacker incentive compared to higher-impact browser UAFs. |
| Impact | The CVSS 3.1 score of 4.3 (Medium) is the most reliable severity signal available here: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L indicates a network-reachable, low-complexity attack requiring no credentials but demanding user interaction, with impact limited to low availability disruption. There is a material discrepancy between the description's claim of code execution and the CVSS impact metrics (C:N/I:N) - if remote code execution were achievable, confidentiality and integrity impacts would not be zero; security teams should treat the description's RCE claim as unverified until the full MSRC advisory is reviewed. No EPSS data was provided, and neither CISA KEV listing nor public POC has been reported, all of which align with treating this as a low-urgency, nuisance-tier finding. The real-world exploitation incentive is low: DoS via browser crash is recoverable and provides no persistent access or data exposure. Even resource-constrained IT teams should be able to address this through routine browser update cycles rather than emergency response. |
| Exploit ScenarioDerived | An attacker hosts a malicious webpage containing crafted content designed to trigger the use-after-free condition in Microsoft Edge's memory subsystem. A user who navigates to the page in an unpatched Edge browser experiences a sudden tab or browser crash due to the freed memory being accessed, causing a localized denial-of-service with no data exposure. No public POC has been reported, and replication would require knowledge of the specific freed-memory trigger path within the Chromium engine. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Use-after-free (CWE-416) in Microsoft Edge (Chromium-based) allows a remote, unauthenticated attacker to crash the browser through a crafted webpage, resulting in a denial-of-service condition. Critically, the CVE description claims code execution capability, but the CVSS vector (C:N/I:N/A:L, score 4.3) directly contradicts this - a genuine RCE would produce C:H/I:H impact in the 8-9+ range; this discrepancy should be verified against the full MSRC advisory. No active exploitation has been confirmed and no public POC has been reported; a vendor patch is available via the Microsoft Security Response Center.
RemediationAI
Update Microsoft Edge to the latest available version using the browser's built-in update mechanism (Settings → Help → About Microsoft Edge) or via Windows Update for enterprise-managed deployments. The vendor confirms a patch is available per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66798; the exact patched version number is not specified in the available data and should be confirmed there. Where immediate patching is not possible, a compensating control is to configure Edge enterprise policy to block navigation to untrusted or uncategorized web content using Microsoft Defender SmartScreen or a web proxy allowlist - this reduces exposure since UI:R requires a victim to reach attacker-controlled content, though it may restrict legitimate browsing. No workarounds are expected to be necessary given the low severity and DoS-only impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-416 (Use After Free) occurs when a program continues to reference heap memory after it has been freed, leading to undefined behavior including crashes or, in higher-severity cases, controlled memory corruption. In Chromium-based browsers, UAF bugs typically surface in the rendering engine (Blink), the V8 JavaScript engine, or media/audio subsystems where object lifetimes interact with garbage collection and inter-process messaging. The affected product is identified by CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*, indicating all versions of the Chromium-based Edge line are in scope. Because Microsoft Edge shares the Chromium codebase, vulnerabilities in shared components may have upstream or downstream parallels in other Chromium-derived browsers, though patch timelines differ.
Know when Microsoft Edge Chromium Based gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Network-reachable via malicious webpage requiring passive user navigation (UI:R); C and I remain N because the description's RCE claim is directly contradicted by the DoS-consistent CVSS metrics.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) lets an attacker run arbitrary code in the browser by getting a
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Use-after-free memory corruption in Microsoft Edge (Chromium-based) can let remote attackers execute arbitrary code in t
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Exploit-DB