EUVD-2026-80050
GHSA-6v75-48xv-ggr2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable heap overflow needing no privileges (PR:N) but requiring the victim to open malicious web content (UI:R); full code execution yields C:H/I:H/A:H, scope unchanged.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
AnalysisAI
Heap-based buffer overflow in Microsoft Edge (Chromium-based) versions 1.0.0.0 through 153.0.4234.32 allows remote attackers to execute arbitrary code in the browser by getting a victim to load attacker-controlled web content. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication or privileges are needed but successful exploitation requires user interaction such as visiting a crafted page or opening malicious content rendered by Edge. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the victim to load attacker-controlled web content in Microsoft Edge (Chromium-based) versions 1.0.0.0 through <153.0.4234.32 - the UI:R metric means a user must browse to a malicious page or interact with crafted content; there is no zero-click path in the provided data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority remote code execution flaw, though not the most severe class of browser bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update Microsoft Edge (Chromium-based) to 153.0.4234.32 or later, the first build outside the affected range reported by EUVD; follow the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69486 for channel-specific builds and restart the browser so the new renderer binary is loaded. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which Microsoft Edge (Chromium-based) installations remain on builds 1.0.0.0 through 153.0.4234.32 and prioritize patching internet-facing, executive, and privileged-user endpoints; use Microsoft Update, Microsoft Endpoint Configuration Manager, Intune, or Microsoft Edge enterprise deployment tools to apply the vendor-released security update that supersedes 153.0.4234.32, confirming the exact fixed build in Microsoft's advisory. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today