Microsoft Edge (Chromium-based) Integer Overflow Remote Code Execution Vulnerability

Successful exploitation can result in arbitrary code execution in the context of the affected Microsoft Edge process. The CVSS metadata indicates high impact to confidentiality, integrity, and availability, meaning an attacker could potentially access sensitive data available to the browser context, modify data or application state, and cause process or system instability. Because the flaw is in a browser, exploitation may serve as an initial access vector and could be chained with additional vulnerabilities for broader compromise.

If immediate patching is not possible, reduce exposure by limiting user access to untrusted or attacker-controlled web content, restricting browsing from sensitive administrative contexts, and applying enterprise browser hardening controls. Because the issue requires user interaction, security awareness measures and URL/content filtering may reduce exploit opportunities, but these are only temporary risk-reduction steps and do not remediate the underlying flaw. Administrators should also verify the health and update state of Edge-related runtimes such as Evergreen WebView2 where applicable, given the shared engine noted in the supporting content.

Update Microsoft Edge (Chromium-based) to version 150.0.4078.48 or later, as Microsoft states the July 2026 Stable channel release fixes this vulnerability. Ensure the browser is fully restarted after updating, because Edge updates may be staged until restart and the patched build is not operationally effective until the restart occurs. In enterprise environments, verify deployed and running versions through endpoint management tooling and confirm that systems are actually executing the patched build.