Description
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Published: 2026-07-03
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

CVE-2026-58294 is a use‑after‑free flaw (CWE-416) in Microsoft Edge (Chromium-based) that permits vulnerability qualifies as a remote code execution risk.

Affected Systems

All builds of Microsoft Edge that incorporate the Chromium engine are potentially vulnerable until a patch is applied. The advisory does not specify individual version numbers, so enterprises should treat every current Edge installation as at risk.

Risk and Exploitability

The CVSS score of 7.5 classifies this issue as high severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could trigger the flaw by delivering a crafted web page or network payload that causes the browser to suffer the use‑after‑free, enabling remote code execution without authentication.

Generated by OpenCVE AI on July 21, 2026 at 09:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Microsoft Edge security update for in the Microsoft Security Response Center update guide.
  • Upgrade Microsoft Edge to the latest stable release to ensure the vulnerability is fully patched.
  • Restrict user access to untrusted web content by enforcing least privilege for user accounts and implementing content filtering policies.

Generated by OpenCVE AI on July 21, 2026 at 09:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 03 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Description Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Title Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
First Time appeared Microsoft
Microsoft edge Chromium
Weaknesses CWE-416
CPEs cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft edge Chromium
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Edge Chromium
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-07-24T00:00:42.010Z

Reserved: 2026-06-29T21:59:30.871Z

Link: CVE-2026-58294

cve-icon Vulnrichment

Updated: 2026-07-06T11:17:39.643Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T09:15:02Z

Weaknesses