CVE-2026-58287: Microsoft Edge Use-After-Free RCE Vulnerability (CVSS 8.3)

Technical summary

CVE-2026-58287 is a use-after-free vulnerability (CWE-416) in Microsoft Edge's Chromium engine. Use-after-free flaws occur when a program references memory that has been deallocated, allowing attackers to manipulate freed memory to execute arbitrary code. The vulnerability is reachable over the network and requires user interaction (UI:R) but has low attack complexity (AC:H), suggesting exploitation is technically feasible but may depend on specific conditions or browser state. The attack vector is network-based (AV:N), and the impact scope is changed (S:C), meaning compromise can extend beyond the vulnerable component.

Business impact

Successful exploitation could allow attackers to remotely execute code with the privileges of the user running Microsoft Edge. This enables theft of sensitive data, installation of persistent malware, lateral movement within corporate networks, and disruption of business operations. Organizations with BYOD policies or those relying on Edge for business-critical applications face elevated risk. The requirement for user interaction slightly reduces—but does not eliminate—organizational risk, as social engineering and drive-by downloads remain effective attack vectors.

Affected systems

Microsoft Edge (Chromium-based) is affected. Organizations using Microsoft Edge in enterprise environments, particularly those deployed via Windows Update or Windows Server Update Services (WSUS), should identify and inventory affected instances. Chromium-based variants of Edge across Windows, macOS, and Linux platforms should be considered in scope for assessment.

Exploitability

The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no widespread active exploitation has been reported or confirmed as of the publication date. However, the combination of network accessibility, user interaction requirement, and remote code execution capability suggests that reliable exploits could be developed. Users and administrators should treat this as a credible exploitation risk and prioritize patching.

Remediation

Apply security updates from Microsoft for Microsoft Edge (Chromium-based) as soon as they become available. Monitor the Microsoft Edge release notes and security advisories for patch version numbers and deployment guidance. In the interim, consider restricting Edge usage where possible, disabling problematic extensions, and educating users about the risks of visiting untrusted websites or opening unexpected files.

Patch guidance

Consult Microsoft's official security advisories and the Microsoft Edge release notes for the specific patch version that addresses CVE-2026-58287. Verify patch applicability to your deployed Edge versions—updates may be released through Windows Update, the Microsoft Edge auto-update mechanism, or manual download from microsoft.com. Test patches in a non-production environment before broad rollout. For enterprise deployments, use group policy or mobile device management (MDM) to enforce timely patching across the organization.

Detection guidance

Monitor for crashes or unexpected behavior in Microsoft Edge processes, particularly those involving memory corruption or suspicious code execution. Endpoint Detection and Response (EDR) solutions should be configured to flag use-after-free-style memory violations and browser-based code execution attempts. Web traffic inspection can identify known malicious domains or files associated with exploitation campaigns. Consider enabling browser crash reporting to Microsoft to aid in detection of active exploitation attempts.

Why prioritize this

Although not currently in the KEV catalog, this vulnerability merits rapid patching due to its HIGH CVSS score (8.3), remote exploitability, potential for remote code execution, and wide user base of Microsoft Edge. The user-interaction requirement slightly lowers urgency compared to zero-interaction flaws, but should not delay patching beyond standard security update windows.

Risk score, explained

The CVSS 3.1 score of 8.3 reflects the combination of network attack vector, high impact on confidentiality and integrity, changed scope, and user-interaction requirement. The score appropriately weights the severity of remote code execution against the barrier of requiring user interaction. This score positions the vulnerability as HIGH severity and a strong candidate for prioritization in patch management workflows.

Frequently asked questions