Executive brief
Microsoft Edge, a widely used web browser, is affected by a security flaw that could allow an attacker to run malicious code on a user's computer. To exploit this, an attacker would typically need to trick a user into visiting a specially crafted website or clicking a malicious link. Successful exploitation could lead to a full system compromise, unauthorized data access, or the installation of malware.
Technical details
A use-after-free vulnerability (CWE-416) exists in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48. The flaw occurs when the browser continues to use a pointer after it has been freed, leading to memory corruption. An unauthenticated attacker can exploit this over the network by enticing a user to visit a malicious webpage (User Interaction required). While the attack complexity is rated as high, successful exploitation allows for remote code execution (RCE) within the context of the browser process. Microsoft has released updates to address this vulnerability.
Affected products
- Microsoft Edge (Chromium-based) 1.0.0.0 to 150.0.4078.48
Timeline
- 2026-07-03: disclosed
- 2026-07-03: advisory