Loading vulnerability…
Remote Code Execution in Microsoft Edge (Chromium-based)
CVE-2026-58293 is a high-severity remote code execution vulnerability in Microsoft Edge (Chromium-based) caused by external control of a file name or path. The flaw allows an unauthorized attacker to influence file path handling in a way that can lead to code execution. Available information identifies Microsoft Edge (Chromium-based) as the affected product and indicates the issue was addressed in builds prior to version 150.0.4078.48.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in remote code execution in the context of the affected Microsoft Edge process. The associated severity metadata indicates high impact to confidentiality, integrity, and availability, meaning an attacker could potentially execute arbitrary code, access sensitive data available to the browser context, modify data, or cause service disruption.
If you can’t patch tonight, do this now.
Apply the latest Microsoft Edge security updates as soon as possible. Until patching is completed, reduce exposure by limiting use of untrusted web content and enforcing standard browser hardening and application update policies where feasible.
Patch, then assume compromise.
Upgrade Microsoft Edge (Chromium-based) to version 150.0.4078.48 or later and apply the relevant Microsoft security updates released for this issue.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.