EUVD-2026-41588
GHSA-rp87-gqr5-74pm
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
Network browser flaw needing a lured user (UI:R) under hard-to-control conditions (AC:H), no auth (PR:N), with a renderer-to-host sandbox escape (S:C) yielding code execution.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
Lifecycle Timeline
2DescriptionCVE.org
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated attacker run code on a victim's machine when the user is lured into interacting with attacker-controlled web content. The flaw stems from improper input validation (CWE-20) and, per its CVSS scope-change metric, is consistent with a renderer/sandbox boundary escape. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires user interaction (UI:R): the victim must actively browse to or engage with attacker-controlled web content in Microsoft Edge, so purely passive or zero-click compromise is not indicated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious web page or a booby-trapped resource and persuades a victim to visit it, for example via a phishing link or a compromised ad. When the victim's Microsoft Edge processes the attacker-controlled content, improperly validated input triggers the flaw and, given the changed scope, escapes the renderer to execute code on the host. … |
| Remediation | Update Microsoft Edge to the fixed build referenced in Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58292; a patch is available per vendor advisory, though an exact fixed version number is not provided in the input data and should be read directly from that MSRC page. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Microsoft Edge deployments and assess user exposure; notify stakeholders of the vulnerability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run
Privilege elevation in Microsoft Edge (Chromium-based) lets a network attacker escalate privileges by luring a victim in
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) via a type-confusion flaw (CWE-843) lets an unauthorized attack
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthorized attacker to run arbitrary code when a vi
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today