Executive brief
Microsoft Edge, the primary web browser for Windows systems, is affected by a security flaw that could allow an attacker to run malicious code on a user's computer. To exploit this, an attacker would typically need to trick a user into visiting a specially crafted website or clicking a malicious link. If successful, this could lead to a full compromise of the user's workstation, potentially exposing sensitive data or providing a foothold for further attacks within the corporate network.
Technical details
A use-after-free (UAF) vulnerability exists in Microsoft Edge (Chromium-based) due to improper memory management. The flaw is triggered when the browser attempts to access memory that has already been freed, which can be leveraged by a remote, unauthenticated attacker to achieve arbitrary code execution. The attack vector is network-based, though it requires high complexity and user interaction, such as convincing a victim to visit a malicious URL. Microsoft has addressed this in version 150.0.4078.48 and later.
Affected products
- Microsoft Edge (Chromium-based) 1.0.0.0 to 150.0.4078.48
Timeline
- 2026-07-03: advisory: Initial publication of the CVE record by Microsoft and NVD.