Description
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Published: 2026-10-27
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a type confusion flaw that allows an attacker to access a resource using an incompatible type. This flaw can lead to arbitrary code execution when an attacker sends crafted data over the network to Microsoft Edge (Chromium-based). The weakness is catalogued as CWE-843, indicating improper use of a type that can cause unintended behavior.

Affected Systems

Microsoft Edge (Chromium-based) is affected. No specific version range is listed, implying that all releases before the patch may be vulnerable.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity. The EPSS score is not available, and the vulnerability is not currently listed in CISA's KEV catalog. The likely attack vector is remote, with an attacker sending malicious content over a network connection to the browser. If exploited, the attacker can achieve full code execution on the user’s machine, potentially compromising data, system integrity, and availability.

Generated by OpenCVE AI on October 27, 2026 at 21:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest Microsoft Edge update available from the Microsoft Security Update Guide.
  • Configure Windows Update to automatically install browser updates to ensure the vulnerability is remediated in a timely manner.
  • Consider disabling or limiting use of Microsoft Edge for users who do not require it, or switch to an alternative browser with proven mitigations for type confusion issues.

Generated by OpenCVE AI on October 27, 2026 at 21:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft microsoft Edge (chromium-based)
Vendors & Products Microsoft microsoft Edge (chromium-based)

Tue, 27 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Title Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
First Time appeared Microsoft
Microsoft edge Chromium
Weaknesses CWE-843
CPEs cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft edge Chromium
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Edge Chromium Microsoft Edge (chromium-based)
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-10-27T21:24:30.373Z

Reserved: 2026-09-04T18:21:15.992Z

Link: CVE-2026-85898

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-27T21:19:34.117

Modified: 2026-10-27T21:31:20.490

Link: CVE-2026-85898

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T21:45:08Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')