The flaw is a type‑confusion vulnerability that arises when Microsoft Edge interprets an incompatible data type while accessing a resource. This misuse of type handling allows an external actor to execute arbitrary code on the underlying system by delivering specially crafted network content. The primary impact is that an attacker who can supply malicious input to a victim’s Edge instance can gain code‑execution rights, potentially leading to full system compromise if the browser process is sufficient to affect system state.

Microsoft Edge (Chromium‑based) is affected. No specific build or version numbers are listed in the advisory, so all deployments of the Chromium‑based Edge should be considered vulnerable until an update is applied.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% shows that the probability of exploitation at present is low. The flaw is not referenced in the CISA KEV catalog. A likely attack vector is inferred from the wording that the vulnerability can be triggered over a network; an attacker would need to deliver malicious content (e.g., a crafted web page or other network traffic) that forces Edge to perform the type confusion and execute code. The risk is therefore remote code execution via a network‑based attack on the victim’s Edge browser.