Loading vulnerability…
Type Confusion RCE in Microsoft Edge (Chromium-based)
CVE-2026-58285 is a remote code execution vulnerability in Microsoft Edge (Chromium-based) caused by type confusion. The flaw arises from access to a resource using an incompatible type, which can lead to unsafe memory handling during processing of attacker-controlled content. An unauthorized attacker can trigger the vulnerability over the network by causing the browser to process specially crafted web content or a crafted file, potentially resulting in arbitrary code execution in the context of the browser process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution in the context of Microsoft Edge (Chromium-based). Because the vulnerability is reachable through attacker-controlled web content and requires no prior authentication, it can be used to compromise confidentiality, integrity, and availability on the affected system. The available scoring information indicates high impact across all three dimensions.
If you can’t patch tonight, do this now.
No dedicated workaround is identified. Until patches are fully deployed, reduce exposure by limiting access to untrusted websites and preventing users from opening untrusted files or attachments in Microsoft Edge. Standard browser hardening and prompt update deployment reduce the attack window.
Patch, then assume compromise.
Update Microsoft Edge (Chromium-based) to version 150.0.4078.48 or later. Apply the vendor-provided security updates to ensure the vulnerable code path is replaced with the patched version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.