EUVD-2026-76143
GHSA-f6v3-2mxj-x777
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Network vector with high complexity and low privilege confirmed by description; scope change reflects browser sandbox escape with full host-level impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
AnalysisAI
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execution with scope change across all supported platforms including Windows, Linux, macOS, Android, and iOS. The vulnerability carries a CVSS 8.5 with high complexity and scope change (S:C), indicating that successful exploitation escapes the browser's sandboxing boundary and affects the underlying host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold at least low-privilege authorization (PR:L) - an authenticated session or similar granted access - before the UAF trigger can be reached over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a meaningful but constrained risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch immediately via the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70341. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Microsoft Edge deployments across Windows, Linux, macOS, and mobile devices to identify affected systems and establish baseline patch levels. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Microsoft Edge For Android
View allExternal file path control in Microsoft Edge for Android (versions below 151.0.4129.59) allows a local low-privileged at
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop a
UI spoofing in Microsoft Edge for Android (versions below 148.0.3967.55) allows a remote, unauthenticated attacker with
Improper input validation in Edge for Android allows a remote attacker to tamper with data over a network by convincing
Spoofing in Microsoft Edge for Android versions below 148.0.3967.55 allows a network-based attacker to misrepresent crit
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today