EUVD-2026-111391
GHSA-qvvf-m4mf-g99c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
ExploitServe content crafted to trigger double free
-
ExecutionCorrupt memory in Edge processing path
-
ImpactExecute attacker code in browser context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Double free prevention
|
| Exploitation Conditions | Exploitation requires the victim to use a vulnerable Microsoft Edge (Chromium-based) build - any version from 1.0.0.0 up to but not including 154.0.4258.48 - and to visit attacker-controlled or compromised web content (UI:R, user interaction required). It is network-delivered and unauthenticated (PR:N): no credentials or special Edge configuration are indicated by the available data. The principal limiting factor is that the attack is not fully automatic - the user must navigate to or render the malicious page - and installing the vendor update (154.0.4258.48 or later) removes exposure. |
| Impact | This is a genuine high-priority issue. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated memory-corruption bug (CWE-415 double free) yielding full confidentiality/integrity/availability impact - the classic profile of a browser remote code execution triggered by viewing malicious web content, with the single mitigating factor being required user interaction (UI:R). A vendor patch from Microsoft (MSRC) is available and the vuln.today decision label is 'this_week', indicating prompt but not emergency remediation. No EPSS score, no CISA KEV listing, and no public exploit reference were supplied, so the real-world exploitation signal is currently weak: no public exploit identified at time of analysis. The practical risk is therefore driven by the product's enormous deployment footprint and the ease of mass-delivery (a lured page), not by any confirmed in-the-wild activity. Note a data conflict: the input carries an 'Authentication Bypass' tag, which contradicts the CWE-415 double-free classification and the code-execution description - treat that tag as erroneous. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page that serves content crafted to trigger the double free in Edge's rendering/processing path. A victim running an unpatched Edge build (below 154.0.4258.48) visits the page, and the resulting memory corruption lets the attacker execute code in the browser's context. No public exploit code was identified in the supplied data; user interaction (navigating to the page) is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Memory-safety flaw in Microsoft Edge (Chromium-based) that can lead to remote code execution. All builds from 1.0.0.0 through 154.0.4258.48 are affected; an attacker who lures a user to a malicious or compromised web page can corrupt memory and, potentially, run code in the browser's context. The host is network-reachable and unauthenticated (AV:N/PR:N), though exploitation is not fully automatic because the victim must render the attacker's content (UI:R). No public exploit code or active exploitation has been confirmed by the available sources, and a vendor patch - Edge 154.0.4258.48 - is published and should be applied this week per the priority signal.
RemediationAI
Update Microsoft Edge (Chromium-based) to version 154.0.4258.48 or later; per the Microsoft advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83831) an update is available from the vendor, and installing it removes exposure for the browser itself. The priority signal for this CVE is this_week, so the update should be scheduled accordingly rather than deferred to the next routine cycle. Note that on managed fleets individual users can push their installed build an edition ahead, so check the actual on-disk version (edge://version) rather than relying on the update having been offered. If immediate deployment is not possible, the residual exposure can be reduced by preventing the browser from reaching attacker-controlled or unvetted web content - for example enforcing blocklists and restricting browsing on high-value endpoints - but this is a compensating control only and does not fix the underlying memory-safety issue; the vendor's complete fix is the version update. Undoing or postponing the update leaves the double-free reachable whenever a user renders hostile content.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a double free (CWE-415) inside the Chromium engine embedded in Microsoft Edge. A double free occurs when the same allocated object is released twice, letting a second free operate on memory that may already have been recycled; in a browser that is a classic route to heap corruption and attacker-influenced control flow. Chromium's multi-process sandbox and its allocator hardening (partitioned, quarantined frees) make reaching code execution more demanding than in an unsandboxed target, and the supplied sources do not describe the triggering code path, so the specific parser or feature involved is not confirmed. Affected builds are identified by the generic CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based); the vendor and ENISA list the affected range as every Edge build below 154.0.4258.48, i.e. from 1.0.0.0 up. Because fixed version 154.0.4258.48 appears to track the Chromium release line, the underlying defect likely also originates in upstream Chromium; the supplied references give only the Microsoft advisory, so upstream propagation to other Chromium-derived browsers is not verified here.
Know when Microsoft Edge Chromium Based gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered browser RCE needing no privileges (PR:N) but requiring the victim to load malicious content (UI:R); double free yields full code-execution impact (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorNVD
DescriptionNVD
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity memory-safety flaw in Microsoft Edge could allow an attacker to execute code in the browser context on affected workstations, with all Edge builds up to 154.0.4258.48 exposed until remediated. Because exploitation requires luring a user to visit malicious or compromised content, organizational risk concentrates on the browsing habits of the general workforce rather than on server infrastructure. Leadership should care because a single successful compromise of an unpatched browser can serve as a foothold into corporate environments, and remediation is straightforward since a vendor fix already exists.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) lets an attacker run arbitrary code in the browser by getting a
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Use-after-free memory corruption in Microsoft Edge (Chromium-based) can let remote attackers execute arbitrary code in t
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Exploit-DB