Loading vulnerability…
Remote Code Execution in Microsoft Edge (Chromium-based) via Integer Overflow or Wraparound
CVE-2026-57974 is a high-severity remote code execution vulnerability in Microsoft Edge (Chromium-based) caused by an integer overflow or wraparound condition. The flaw affects Edge versions prior to 150.0.4078.48. Specific vulnerable code paths are not publicly described in the available information, but the issue class indicates that improper handling of integer arithmetic can lead to incorrect memory sizing, bounds calculation, or related unsafe state, ultimately enabling code execution in the browser context when processing attacker-controlled content.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an unauthorized attacker to execute arbitrary code in the context of Microsoft Edge. Given the published CVSS characteristics, exploitation can result in high impact to confidentiality, integrity, and availability, including compromise of data accessible to the browser session, modification of user data or application state, and potential browser process compromise.
If you can’t patch tonight, do this now.
Apply the latest Microsoft Edge security updates on an expedited basis and restart the browser to activate the patched version. Until patching is complete, reduce exposure by limiting access to untrusted web content, restricting high-risk browsing from sensitive systems, and prioritizing monitoring of browser update compliance across endpoints. Environments using Edge-derived components should also verify that associated runtime components are current where applicable.
Patch, then assume compromise.
Upgrade Microsoft Edge (Chromium-based) to version 150.0.4078.48 or later and ensure the vendor security update released in July 2026 is fully applied. Because browser updates may not become effective until restart, affected systems should verify that the running browser version reflects the patched build after restart. Enterprise environments should also validate update deployment status through endpoint management processes.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.