Skip to main content

Microsoft Edge Chromium Based EUVDEUVD-2026-41652

| CVE-2026-57988 HIGH
Relative Path Traversal (CWE-23)
2026-07-03 microsoft GHSA-62v5-4xc7-qm62
Path Traversal Google Microsoft Microsoft Edge Chromium Based
7.1
CVSS 3.1 · Vendor: microsoft
Temporal: 6.2
View

Vulnerability Assessment

Weakness
CWE
CWE-23
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Relative path traversal prevention
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 03, 2026

Code execution via relative path traversal in Microsoft Edge (Chromium-based) allows a remote unauthenticated attacker to run arbitrary code when a user is lured into interacting with attacker-controlled content, consistent with the CVSS PR:N/UI:R vector. Rated CVSS 7.1 with high integrity impact (I:H), low availability impact (A:L), and no confidentiality impact (C:N). No public exploit identified at time of analysis (exploit maturity Unproven, E:U) and the CVE is not in CISA KEV, but an official vendor fix is available (RL:O).

Affected VersionsENISA

Microsoft Edge (Chromium-based) 1.0.0.0 <150.0.4078.48

Affected Packages

microsoft edge_150_0_4078_48 fix: Microsoft Edge (Chromium-based) 150.0.4078.48
euvd microsoft_edge_chromium_based fix: 150.0.4078.48

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in microsoft, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Microsoft Edge Chromium Based gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
CIRCL (temporal) 6.2 MEDIUM

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low

DescriptionCVE.org

Relative path traversal in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Executive ViewAI

Why It Matters

Microsoft Edge users face remote code execution risk when visiting attacker-controlled websites, potentially compromising sensitive business data and system integrity across your organization. Immediate patching is critical to prevent unauthorized access and data exfiltration.

Recommended Action

Within 24 hours: Notify all Edge users and enable automatic updates; verify patch version availability from Microsoft security advisory. Within 7 days: Confirm patch deployment across all Edge installations in your environment. Within 30 days: Conduct security awareness training on malicious links and assess system logs for unauthorized access indicators.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.5%
Top 58% exploitable
Vendor Action
See Below
Required. The vulnerability documented by this CVE requires customer action to resolve.
Vendor Status
Publicly Disclosed:No
Exploited:No
Latest Software Release:Exploitation Unlikely
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.5%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

37
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

More in Microsoft Edge Chromium Based

View all
CVE-2026-58289 HIGH POC
8.3 Jul 03

Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run

CVE-2026-57983 CRITICAL
10.0 Jul 03

Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
CVE-2026-45495 CRITICAL
9.8 May 18

Remote code execution in Microsoft Edge (Chromium-based) lets an attacker run arbitrary code in the browser by getting a
CVE-2026-66321 CRITICAL
9.6 Aug 03

Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
CVE-2026-66312 HIGH
8.8 Aug 03

Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
CVE-2026-85898 HIGH
8.8 Oct 27

Type confusion (CWE-843) in Microsoft Edge (Chromium-based) allows an unauthenticated remote attacker to execute arbitra
CVE-2026-83831 HIGH
8.8 Oct 27

Memory-safety flaw in Microsoft Edge (Chromium-based) that can lead to remote code execution. All builds from 1.0.0.0 th
CVE-2026-66326 HIGH
8.8 Aug 03

Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
CVE-2026-70341 HIGH
8.8 Sep 11

Use-after-free memory corruption in Microsoft Edge (Chromium-based) can let remote attackers execute arbitrary code in t
CVE-2026-57981 HIGH
8.8 Jul 03

Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
CVE-2026-57974 HIGH
8.8 Jul 03

Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
CVE-2026-56645 HIGH
8.8 Jul 03

Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ

Same weakness CWE-23 – Relative Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2024-27199 HIGH POC
7.3
CVE-2025-34510 HIGH POC
8.8
CVE-2026-76519 CRITICAL POC
9.8
CVE-2026-34926 MEDIUM POC
6.7
CVE-2024-24578 CRITICAL POC
9.8
CVE-2025-52207 CRITICAL POC
9.9
CVE-2023-6825 CRITICAL POC
9.9

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8

References

Advisories & patches
PATCH https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57988 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-57988 ADVISORY https://vuldb.com/vuln/376234

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy