A double free bug in Microsoft Edge (Chromium-based) allows an unauthorized network attacker to execute arbitrary code. The vulnerability permits manipulation of memory freeing routines inside the browser engine, giving the attacker control over process execution paths. Successful exploitation can compromise user data, elevate privileges, and enable further lateral movement within the host system.

Microsoft Edge (Chromium-based) across all currently available builds are potentially affected; no specific version range is provided in the advisory, so all installations must be assumed vulnerable until the official patch is applied.

The CVSS score of 8.8 indicates high severity with wide-impact potential. EPSS data is not available, but the lack of a KEV listing suggests no confirmed exploitation yet. Attack likely requires delivering malicious web content or a crafted resource to the victim’s Edge browser over a network; no local privilege escalation or user interaction beyond browsing is described.