Loading vulnerability…
Remote Code Execution in Microsoft Edge Type Confusion
CVE-2025-49713 is a type-confusion vulnerability in Chromium-based Microsoft Edge. Accessing a resource with an incompatible type can allow an unauthorized attacker to execute code over a network. Exploitation involves attacker-controlled web content and requires the victim to interact with it, such as by following a link to a specially crafted website.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits remote code execution through Microsoft Edge in the context reached by the browser exploit.
If you can’t patch tonight, do this now.
Until all endpoints are updated, reduce exposure to attacker-controlled web content by restricting access to suspicious links, websites, and unsolicited email or instant-message attachments. User awareness measures should emphasize phishing and other social-engineering lures that direct users to malicious pages.
Patch, then assume compromise.
Update Microsoft Edge to version 138.0.3351.65 or later. This version, released July 1, 2025, includes the official fix for CVE-2025-49713.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.