Loading vulnerability…
Use-after-free remote code execution in Microsoft Edge
CVE-2026-50521 is a use-after-free vulnerability in Microsoft Edge (Chromium-based) that allows an authorized attacker to execute arbitrary code over a network. The vulnerability is rated High with a reported CVSS score of 8.3. The affected component, vulnerable function, and precise triggering conditions have not been identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise confidentiality and integrity through arbitrary code execution on the affected system and can also affect availability. The execution security context and whether exploitation bypasses the browser sandbox are not established.
If you can’t patch tonight, do this now.
No separate workaround or temporary mitigation is identified. Apply the applicable Microsoft Edge security updates.
Patch, then assume compromise.
Install the latest supported Microsoft Edge release containing the Microsoft security fix, restart the browser to activate the update, and verify the running version through endpoint management tooling. Confirm the applicable fixed build against Microsoft's advisory because the supplied version information is inconsistent.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.