Loading vulnerability…
Use-After-Free RCE in Microsoft Edge (Chromium-based)
CVE-2026-58288 is a high-severity use-after-free vulnerability in Microsoft Edge (Chromium-based). The flaw can allow an unauthorized attacker to execute code over a network. Available scoring information indicates low attack complexity, no privileges required, and required user interaction, which is consistent with exploitation through malicious web content rendered by the browser. Specific vulnerable components, functions, and root-cause details are not publicly provided in the available information.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in remote code execution in the security context of the targeted Microsoft Edge process. Available impact data indicates high confidentiality and high integrity impact, enabling an attacker to run arbitrary code, access sensitive data available to the browser context, and modify data or application state. No direct availability impact is indicated in the available scoring information.
If you can’t patch tonight, do this now.
Apply the latest Microsoft Edge security updates as soon as possible. Until patching is complete, reduce exposure by limiting user interaction with untrusted web content, enforcing browser and application control policies, and using endpoint protections that can detect or block browser exploitation activity. Prioritize patching on systems that regularly access untrusted internet content.
Patch, then assume compromise.
Upgrade Microsoft Edge (Chromium-based) to version 150.0.4078.48 or later and apply the vendor-provided security updates released on 2026-07-03. Ensure browser deployments across managed endpoints are updated to a fixed build.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.