Executive brief
Microsoft Edge, the primary web browser for Windows systems, is affected by a security flaw that could allow an attacker to execute malicious code on a user's computer. To exploit this, an attacker would typically need to trick a user into visiting a specially crafted website or clicking a malicious link. Successful exploitation could lead to a full compromise of the user's system, potentially resulting in data theft or unauthorized access to corporate resources.
Technical details
A use-after-free (UAF) vulnerability exists in Microsoft Edge (Chromium-based) due to improper memory management. The flaw (CWE-416) can be triggered when the browser attempts to access memory that has already been freed, leading to memory corruption. An unauthenticated attacker can exploit this by hosting a malicious website and inducing a user to visit it (User Interaction required). While the attack vector is network-based, the complexity is rated as high, likely due to the need for specific heap grooming or bypassing modern browser mitigations. Successful exploitation allows for remote code execution (RCE) within the context of the browser process. Microsoft has addressed this in versions 150.0.4078.48 and later.
Affected products
- Microsoft Edge (Chromium-based) 1.0.0.0 to 150.0.4078.48
Timeline
- 2026-07-03: disclosed
- 2026-07-03: advisory