CVE-2026-58289: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Synopsis

A type confusion vulnerability in Microsoft Edge (Chromium-based) allows an unauthenticated remote attacker to execute arbitrary code on affected systems. The flaw is reachable over the network with no credentials required, though exploitation involves high attack complexity due to environmental or timing conditions. Successful exploitation gives an attacker full code execution capability, with high impact to confidentiality, integrity, and availability in a scope that extends beyond the browser process itself. A patched-image rebuild at version 150.0.4078.48 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected Edge instance over a network, as the vulnerability is exposed via a network-accessible attack vector (AV:N).

• AuthenticationNot required

  No credentials or prior account access are needed; the attack can be launched by an unauthenticated party (PR:N).

• Victim interactionNot required

  No user action such as clicking a link or opening a file is required to trigger the vulnerability (UI:N).

• Attack complexityDetail

  Exploitation is rated high complexity (AC:H), meaning the attacker must account for specific environmental conditions, timing constraints, or memory layout factors to reliably trigger the type confusion.

Blast Radius

• A successful attacker executes arbitrary code in the context of the browser process, with impact scoped beyond the browser itself due to the Changed scope (S:C) rating.
• Confidentiality impact is high: the attacker reads sensitive data accessible to the process, including stored credentials, session tokens, and browsing history.
• Integrity impact is high: the attacker modifies files, persisted data, or system state reachable from the compromised process.
• Availability impact is high: the attacker crashes or fully disrupts the affected service or host processes dependent on it.