CVE-2026-57981: Microsoft Edge Chromium Use-After-Free Code Execution (CVSS 8.8)

Technical summary

CVE-2026-57981 is a use-after-free vulnerability (CWE-416) in the Chromium-based rendering engine of Microsoft Edge. The vulnerability exists in memory management where a previously freed object is accessed, leading to arbitrary code execution. The attack vector is network-based (AV:N), requires low attack complexity (AC:L), involves no privilege requirement (PR:N), and mandates user interaction (UI:R). The impact scope is unchanged (S:U), but confidentiality, integrity, and availability are all fully compromised (C:H/I:H/A:H). CVSS 3.1 score: 8.8 (HIGH).

Business impact

Exploitation enables attackers to execute malware, steal sensitive data, or compromise system integrity on affected user machines. In enterprise environments, this could lead to credential theft, lateral movement, or deployment of ransomware. The user-interaction requirement means attack campaigns must be crafted to lure victims to malicious or compromised legitimate websites. Organizations should prioritize remediation to prevent browser-based supply chain compromises and targeted phishing attacks leveraging this vector.

Affected systems

Microsoft Edge (Chromium-based) is the sole affected product. This covers all versions of the modern Edge browser that use the Chromium rendering engine (versions 79 and later). Organizations with Windows 10 and Windows 11 deployments using Edge as the standard browser are in scope. Users of earlier Edge Legacy (EdgeHTML-based) versions are not affected.

Exploitability

The vulnerability requires user interaction—a victim must visit a malicious or compromised website to trigger the flaw. No exploit exists in the public domain at this time, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity and lack of authentication requirements mean that once a weaponized variant emerges, exploitation could scale rapidly across web-based phishing and watering hole campaigns. The barrier to weaponization is moderate; skilled attackers can develop reliable exploits.

Remediation

Apply the latest security update from Microsoft for Edge as soon as it becomes available. Check the official Microsoft Edge update page or Windows Update for patch availability. For organizations with managed deployments, configure Edge to auto-update or use group policies to enforce the latest version. No workarounds are available; patching is the only mitigation. Verify patch deployment across your estate before considering risk fully mitigated.

Patch guidance

Monitor Microsoft's official security advisory and Edge release notes for patch details and version numbers. Deploy updates via Windows Update, the Microsoft Edge updater, or your endpoint management platform. Coordinate testing in non-production environments if your organization enforces change control. Prioritize deployment within 30 days of patch release given the HIGH severity and user-interaction attack vector. Confirm successful updates by checking Edge version numbers on affected machines.

Detection guidance

Monitor for suspicious Edge process behavior such as unexpected child process creation, network connections to unfamiliar domains, or unusual memory access patterns. Endpoint Detection and Response (EDR) tools should flag use-after-free exploitation attempts via memory corruption signatures. Track user visits to known-malicious or newly-registered domains that may host exploit payloads. Web gateway logs may reveal pattern-of-life anomalies if campaigns target your organization. Configure browser security event logging where possible.

Why prioritize this

HIGH CVSS score (8.8) combined with the ubiquity of Edge, low attack complexity, and high impact across confidentiality, integrity, and availability warrant immediate prioritization. Although user interaction is required, widespread phishing and watering hole campaigns can deliver at scale. The absence of KEV designation does not reduce risk; this is a newly disclosed critical browser vulnerability in a mainstream product used by millions. Remediate before adversaries mature exploitation techniques.

Risk score, explained

CVSS 3.1 score of 8.8 reflects network-based delivery (AV:N), low attack barriers (AC:L, PR:N), and complete compromise of core security objectives (C:H/I:H/A:H) offset only by the requirement for user interaction (UI:R). The unchanged scope (S:U) keeps this below critical (9.0+), but the practical combination of widespread exposure and reliable exploitation potential justifies treating this as a top-tier organizational priority.

Frequently asked questions