Microsoft Edge (Chromium-based) contains a vulnerability that allows an attacker to execute arbitrary code within the browser process. The flaw is classified under CWE‑119, CWE‑20, CWE‑35 and CWE‑94 and can result in a full compromise of the user’s machine. The impact on confidentiality, integrity and availability can be substantial, permitting the attacker to read, modify or delete data and potentially spread laterally within a network.

The affected product is Microsoft Edge (Chromium‑based). No specific releases were identified in the advisory, so until Microsoft publishes a patch all current versions of the browser should be considered at risk.

The CVSS score of 8.8 indicates a high severity. EPSS is 0.00195, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a malicious or compromised web page that the user opens in Edge, requiring user interaction with the browser but no additional privileges. The exploit can be executed from a remote host without needing elevated rights on the target system.