EUVD-2026-76143
GHSA-f6v3-2mxj-x777
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to attacker-controlled page
-
DeliveryServe crafted web content to Edge
-
ExploitTrigger use-after-free in engine
-
ExecutionExecute arbitrary code in browser context
-
ImpactCompromise user session and data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a targeted user to open or render attacker-controlled web content (a malicious or compromised page) in an unpatched Microsoft Edge build prior to 152.0.4191.52 on any supported platform (Chromium-based desktop, Android, iOS, Linux, macOS). Limiting factors that reduce real-world risk: the victim must interact with the malicious content (typical for a browser UAF, despite the vendor vector stating UI:N), the renderer/browser sandbox may contain the initial code execution, and the fixed version is already available so patched installations are not exposed. The vendor's 'authorized attacker' phrasing and PR:L metric should be reconciled with the advisory to determine whether any prior access is genuinely required. |
| Impact | Signals conflict between high technical severity and low observed exploitation. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N) and SSVC 'Technical Impact: total' reflect a memory-corruption bug (CWE-416) that can yield full code execution on the victim host, and CPE data confirms it spans every Edge platform (Windows/Chromium-based, Android, iOS, Linux, macOS). However, the exploitation-side signals are modest: EPSS is only 0.62% (48th percentile - roughly average, not elevated), there is no public exploit identified at time of analysis, the vulnerability is NOT in CISA KEV, and SSVC rates Exploitation 'none' and Automatable 'no'. Net: this is a serious-but-routine browser patch priority, not an active-incident emergency. One discrepancy must be verified with the vendor: the Microsoft/NVD vector lists PR:L and UI:N, yet a Chromium use-after-free that an 'attacker [executes] over a network' is almost always triggered by the victim rendering attacker-controlled web content, which would normally be PR:N/UI:R - the vector's privilege and user-interaction metrics should be confirmed against the MSRC advisory before relying on them for prioritization. |
| Exploit ScenarioDerived | An attacker hosts or injects malicious web content that, when rendered by a vulnerable Edge build (before 152.0.4191.52), triggers a use-after-free in the browser engine and executes attacker code in the browser process context. No public exploit code has been identified at time of analysis, and SSVC rates exploitation as 'none', so this is currently a theoretical rather than observed attack path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 06, 2026
Use-after-free memory corruption in Microsoft Edge (Chromium-based) can let remote attackers execute arbitrary code in the browser process after the victim renders attacker-controlled web content in an unpatched build prior to 152.0.4191.52. All supported platforms are in scope - desktop Chromium-based Edge plus Edge for Android, iOS, Linux, and macOS - so the affected install base is broad even though the observed risk signal is currently low. Microsoft rates this 8.8 with a PR:L/UI:N vector while the independent assessment treats it as unauthenticated remote code execution that requires a targeted user to open or render a malicious or compromised page (PR:N/UI:R); no public exploit code has been identified and CISA's SSVC records exploitation as none, with EPSS at only 0.62% (48th percentile).
Earlier versions of this analysis (1)
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execution with scope change across all supported platforms including Windows, Linux, macOS, Android, and iOS. The vulnerability carries a CVSS 8.5 with high complexity and scope change (S:C), indicating that successful exploitation escapes the browser's sandboxing boundary and affects the underlying host. No public exploit or CISA KEV listing is present at time of analysis, though patch-available status from Microsoft confirms vendor acknowledgment.
RemediationAI
Vendor-released patch: Microsoft Edge 152.0.4191.52, which is the fixed build boundary for every affected platform, so upgrade desktop Chromium-based Edge and the Android, iOS, Linux, and macOS clients to 152.0.4191.52 or later and confirm the version in the browser's about page. Mobile clients are updated through the Google Play Store, Apple App Store, and Linux distribution/package channels, so standard channel updates may lag on managed fleets; force an update check or push the app version through MDM/MAM rather than assuming automatic delivery. After patching, verify via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70341 rather than relying on third-party mirrors. If immediate patching is not possible, compensating controls are limited but actionable: enforce Chromium Site Isolation and keep renderer sandboxing enabled (trades some performance and can break sites relying on cross-origin frames), disable or gate third-party browser extensions and untrusted plug-ins, and for managed endpoints deploy Microsoft Defender Exploit Protection mitigations - Arbitrary Code Guard, Control Flow Guard, and Code Integrity Guard - against msedge.exe, accepting that these can cause crashes or functional regressions in some builds. Network-side, restrict user browsing to allow-listed categories via a secure web gateway or proxy (trade-off: reduces productivity and generates false positives), and monitor EDR/AV telemetry for renderer crashes followed by unexpected child processes or outbound connections from msedge.exe as a UAF exploitation indicator. Because no public exploit code has been identified at time of analysis and EPSS is only 0.62% (48th percentile), treat this as a patch-within-normal-cycle item rather than an emergency, but prioritize any endpoint that must browse untrusted content.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, use-after-free, in the Chromium rendering engine that underlies Microsoft Edge. A UAF occurs when a heap object - typically a DOM node, layout object, or JavaScript engine structure - is freed while a stale reference to it survives; the attacker then forces allocation of attacker-influenced data into the reclaimed memory to achieve a type confusion and redirect control flow. Because this is upstream Chromium-derived code (the tag set includes Google alongside Microsoft), the same defect class routinely affects multiple Chromium consumers, which is why the CPE list spans the desktop browser and the Android, iOS, Linux, and macOS builds. The tag set also lists Memory Corruption and Denial Of Service, consistent with a UAF that can crash the renderer before any exploitation succeeds. The vendor describes an 'authorized attacker' and assigns PR:L, implying some precondition may exist, whereas the independent assessment models the realistic attack as a drive-by: the user must interact with malicious web content (UI:R), no authentication or network position is required, and the renderer/browser sandbox may contain the initial code execution so that a full sandbox escape would be a separate step. Confidentiality, integrity, and availability impacts are all High if code execution lands in a privileged context.
Know when Microsoft Edge For Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
A Chromium use-after-free is network-reachable via web content with no attacker privileges (PR:N) but requires the victim to render a malicious page (UI:R), yielding full host impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
Executive ViewAI
Microsoft Edge contains a memory-corruption vulnerability that could let an attacker execute code on a device when a user renders attacker-controlled web content, and the affected builds are present on every platform Edge supports - Windows, macOS, Linux, Android, and iOS. With no public exploit identified at time of analysis and a vendor fix already published, this is primarily a patch-management exposure across a very large browser estate rather than an active incident. Leadership should treat it as fleet-wide remediation risk: unmanaged or slow-updating endpoints keep the attack surface open indefinitely.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Microsoft Edge For Android
View allExternal file path control in Microsoft Edge for Android (versions below 151.0.4129.59) allows a local low-privileged at
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop a
UI spoofing in Microsoft Edge for Android (versions below 148.0.3967.55) allows a remote, unauthenticated attacker with
Improper input validation in Edge for Android allows a remote attacker to tamper with data over a network by convincing
Microsoft Edge (Chromium-based) on Android contains a user interface misrepresentation vulnerability that allows unauthe
Spoofing in Microsoft Edge for Android versions below 148.0.3967.55 allows a network-based attacker to misrepresent crit
Exploit-DB