Read the docs
TI-2026-82521 Aliases CVE-2026-85890GHSA-mm3h-8x78-xh5v

Microsoft Edge (Chromium-based) Remote Code Execution via Double Free

Priority MEDIUM 41CWE-415Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from Microsoft.

Summary

A double free in Microsoft Edge (Chromium-based) lets an unauthorized attacker execute code over a network. The flaw is tracked as CWE-415 (Double Free) and has a CVSS 3.1 base score of 8.8 (HIGH). Exploitation requires user interaction, and Microsoft rates it as less likely, with no public disclosure or known exploitation. CISA has not added it to KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00573 47th percentileScored 2026-11-07
Fix Fixed Microsoft Edge (Chromium-based) (Microsoft): 154.0.4258.37

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Edge (Chromium-based)1.0.0.0 to before 154.0.4258.37154.0.4258.37Patch availableCNA
  • Microsoft Edge (Chromium-based) VendorMicrosoft Affected 1.0.0.0 to before 154.0.4258.37 Fixed in 154.0.4258.37 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*before 154.0.4258.37VulnerableMicrosoft
  • cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* Versions before 154.0.4258.37 Vulnerable ·Microsoft

Remediation

Update Microsoft Edge (Chromium-based) to version 154.0.4258.37 or later, which fixes the flaw. Versions from 1.0.0.0 before 154.0.4258.37 are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA Microsoft Edge (Chromium-based) (Microsoft) Fixed in 154.0.4258.37

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Remote Code Execution
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely
ProductStatusPlan or fix
Microsoft Edge (Chromium-based)Fixed 154.0.4258.37 · Security Update

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-85890
  2. 2026-10-29 Alias added: GHSA-mm3h-8x78-xh5v
  3. 2026-10-30 CISA SSVC decision points changed
  4. 2026-10-30 Priority changed: MEDIUM → LOW
  5. 2026-10-30 CISA SSVC decision points changed
  6. 2026-10-31 Priority changed: LOW → MEDIUM

References

Patch 1

  • TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2022-03781 Out-of-bounds write in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2025-12953 Memory corruption in Google Chrome KEVCVSS 3.1HIGH 8.8
  • TI-2025-04867 Out-of-bounds read in Google Chrome KEVCVSS 3.1HIGH 8.8
  • TI-2024-07384 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
  • TI-2023-04799 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
See all 325 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences