What is the CVSS score of EUVD-2026-41590?

EUVD-2026-41590 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Edge are affected by EUVD-2026-41590?

Microsoft Edge contains a remote code execution vulnerability (CVE-2026-58294) that allows unauthenticated attackers to compromise endpoints when users visit malicious websites.. A patch is available.

How to fix or mitigate EUVD-2026-41590?

Within 24 hours: Inventory all Microsoft Edge deployments and notify IT and end users of patch availability. Within 7 days: Deploy the Microsoft Edge security patch for CVE-2026-58294 to all organizational endpoints (consult Microsoft Security Update Guide for specific version details). Within 30 days: Confirm patch deployment completion across all systems and implement browser security policies such as restricted website access controls.

Microsoft Edge EUVD-2026-41590

| CVE-2026-58294 HIGH

Use After Free (CWE-416)

2026-07-03 microsoft

GHSA-qqhm-6qqw-68j4

Memory Corruption Google Microsoft Denial Of Service Use After Free Microsoft Edge Chromium Based

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.5 MEDIUM

cvss

vuln.today AI

7.5 HIGH

Remote unauthenticated (AV:N/PR:N) but requires the victim to load malicious content (UI:R) and win a UAF race (AC:H); full RCE gives C/I/A:H with scope unchanged absent a confirmed sandbox escape.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:39 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw that an unauthorized, remote attacker can trigger to run arbitrary code. Exploitation requires the victim to interact with attacker-controlled web content, and the CVSS 3.1 vector marks high attack complexity (AC:H) despite requiring no privileges (PR:N). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host malicious web page with crafted script

Delivery

Lure victim to visit page

Exploit

Trigger use-after-free in renderer

Execution

Groom heap and win race

Persist

Corrupt memory to hijack control flow

Impact

Execute arbitrary code in browser

Access

Host malicious web page with crafted script

Delivery

Lure victim to visit page

Exploit

Trigger use-after-free in renderer

Execution

Groom heap and win race

Persist

Corrupt memory to hijack control flow

Impact

Execute arbitrary code in browser

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to actively interact with attacker-controlled web content in Microsoft Edge (CVSS UI:R) - for example navigating to a malicious page or interacting with a crafted element - so a purely passive, no-interaction remote attack is not indicated. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are moderate rather than urgent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page containing crafted HTML/JavaScript that triggers the use-after-free in Edge's renderer, then lures a victim to visit it via a phishing link, malicious ad, or compromised site. When the victim's Edge browser processes the page, the dangling pointer is exploited to corrupt memory and execute attacker-controlled code in the browser process context. …
Remediation	Patch available per vendor advisory: update Microsoft Edge (Chromium-based) to the fixed build published by Microsoft at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58294; the exact patched version is not provided in the input data and should be confirmed from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report.