Quick answers
- Is CVE-2026-72970 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-72970 being exploited in the wild.
- How severe is CVE-2026-72970?
- High severity, with a CVSS score of 8.3, published 14 August 2026.
- Which products and versions are affected?
- Microsoft Edge.
- Is there a fix for CVE-2026-72970?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-72970 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-72970?
- Check whether you run Microsoft Edge or Microsoft Edge Chromium. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap-based buffer overflow exists in Microsoft Edge (Chromium-based browser). The vulnerability can be exploited over the network without authentication; an attacker crafts a malicious webpage that, when visited by a user, triggers the overflow condition in memory. This allows arbitrary code execution within the browser process with user privileges. Microsoft has released a security update to address this issue.
Affected products
- Microsoft Edge
Timeline
- 2026-08-14: disclosed