Loading vulnerability…
Use-After-Free RCE in Microsoft Edge (Chromium-based)
CVE-2026-58287 is a use-after-free vulnerability in Microsoft Edge (Chromium-based). The flaw can be triggered by an unauthorized attacker over a network and may lead to remote code execution in the context of the browser process. Available scoring information indicates low attack complexity, no privileges required, and required user interaction, consistent with exploitation through malicious web content rendered by the browser. The issue affects Microsoft Edge (Chromium-based) prior to the patched releases referenced in July 2026 security updates.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow arbitrary code execution within the security context of the targeted Microsoft Edge process. Because the vulnerability is rated with high confidentiality, integrity, and availability impact, exploitation may enable theft of sensitive browser-accessible data, modification of data or application state, and browser or system instability. In practical terms, an attacker could leverage a crafted webpage or similar network-delivered content to compromise a victim who interacts with the malicious content.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting access to untrusted or attacker-controlled websites, restricting users from opening untrusted links and attachments that launch browser content, and applying browser hardening and application control measures where feasible. Standard exploit mitigations such as sandboxing, least-privilege user contexts, and endpoint detection may reduce post-exploitation impact, but no dedicated vendor workaround is identified.
Patch, then assume compromise.
Apply the Microsoft Edge (Chromium-based) security updates released in July 2026 and upgrade to a fixed version. Available advisory information indicates that affected builds prior to version 150.0.4078.48 were addressed, and later July guidance references updating to version 150.0.4078.99. Organizations should deploy the latest vendor-provided Edge release available for their channel rather than relying on an intermediate fixed build.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.