EUVD-2026-52524
GHSA-jxgm-6gw2-5xw5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authorized attacker language confirms PR:L; network vector and low complexity align with browser-based network delivery; vendor-confirmed code execution warrants C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects authenticated network attackers (PR:L per CVSS). The CWE-126 flaw allows an authorized attacker to corrupt memory and execute arbitrary code within the browser process over a network channel. No active exploitation is confirmed (not listed in CISA KEV, SSVC exploitation=none), and EPSS of 1.00% at the 59th percentile reflects above-median but still modest real-world exploitation probability.
Technical ContextAI
CWE-126 (Buffer Over-read) describes a condition where a read operation extends beyond the allocated memory buffer boundary, potentially exposing adjacent memory contents or creating exploitable memory corruption primitives. In Microsoft Edge (Chromium-based), this flaw exists in a network-reachable component - the 'Google' tag suggests the root cause may originate in shared upstream Chromium code that Microsoft carries into Edge. The affected CPE is cpe:2.3:a:microsoft:microsoft_edge_(chromium-based), covering all versions from 1.0.0.0 up to but not including 151.0.4129.59 per EUVD data. While CWE-126 is classically associated with information disclosure, the vendor's classification of this as a code execution flaw (C:H/I:H/A:H) suggests the over-read enables a compound exploitation path - potentially using leaked memory layout data to bypass ASLR and achieve code execution.
RemediationAI
Upgrade Microsoft Edge (Chromium-based) to version 151.0.4129.59 or later, which contains the vendor-released patch per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66312. Edge typically auto-updates on managed and consumer endpoints; administrators should verify deployed versions via enterprise management tooling (e.g., Microsoft Intune, Group Policy, or edge://settings/help). If immediate patching is blocked, consider restricting Edge usage to trusted intranet zones and enforcing enhanced security mode to reduce the browser's attack surface. Blocking untrusted network sources via firewall or proxy policies can limit exposure but does not eliminate risk for authenticated attacker scenarios where access already exists.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execu
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today