Microsoft has disclosed a new remote code execution vulnerability affecting Edge, the company’s Chromium-based browser.
Microsoft published the advisory on July 3, 2026, under the CVE-2026-57992 identifier. The flaw stems from a use-after-free memory corruption issue that could allow an unauthorized attacker to execute arbitrary code over a network.
Use-after-free vulnerabilities occur when a program continues to reference a memory location after it has been freed, often allowing attackers to manipulate that memory to hijack program execution.
Microsoft Edge Use-After-Free Flaw
In this case, the flaw resides within Microsoft Edge’s Chromium engine, potentially giving attackers a foothold to run malicious code on a victim’s system.
The CVSS metrics indicate an attack vector of Network (AV:N), High attack complexity (AC:H), and required user interaction (UI:R).
According to Microsoft, exploitation isn’t straightforward: an attacker must craft deceptive or invisible form elements and trick the user into performing two sequential tap gestures, which trigger Edge’s autofill functionality and enable the exploit chain.
Microsoft’s advisory outlines a realistic but constrained exploitation path. An attacker would need to host a specially crafted malicious website and lure a victim there, typically through phishing emails, instant messages, or malicious attachments.
Critically, Microsoft notes that “an attacker would have no way to force a user to view the attacker-controlled content,” meaning social engineering remains essential to any successful attack.
Once on the page, the victim would need to perform two distinct tap actions that activate the autofill mechanism, inadvertently triggering the use-after-free condition and potentially handing code execution capability to the attacker.
Despite the severity implied by remote code execution, Microsoft’s exploitability index rates this vulnerability as “Exploitation Unlikely.” As of publication, the flaw has not been publicly disclosed, and there is no evidence of active exploitation in the wild.
The high attack complexity, combined with the specific multi-step user interaction requirement, significantly reduces the practical risk profile compared to more easily weaponized vulnerabilities.
Affected Versions
Microsoft has released patched versions addressing this vulnerability:
| Microsoft Edge Version | Date Released | Based on Chromium Version |
|---|---|---|
| 150.0.4078.48 | 07/03/2026 | 150.0.7871.47 |
Mitigation
Given the exploitation path, organizations should treat this as a routine but non-negotiable patch cycle item:
- Update Microsoft Edge to version 150.0.4078.48 or later immediately via automatic updates or enterprise deployment tools.
- Educate users on avoiding suspicious links and unexpected tap/click prompts on unfamiliar websites.
- Monitor endpoint detection tools for anomalous Edge process behavior, particularly around autofill-triggered actions.
- Restrict execution of unsolicited file downloads in email and messaging platforms to reduce initial access vectors.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
