CVE-2026-85890: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Published Oct 16, 2026
·Updated
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Other sources
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
— Microsoft
Affected Software
3 affected componentsFixes available
Microsoft Edge (Chromium-based)<154.0.4258.37
154.0.4258.37
Microsoft Edge<154.0.4258.37
154.0.4258.37
Microsoft Edge Chromium<154.0.4258.37
Remediation
Event History
Oct 16, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
Oct 29, 2026
CVE Published
via MITRE·03:09 PM
Data Sourced
via MITRE·03:09 PM
DescriptionSeverity
Data Sourced
via NVD·04:19 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What does an attacker need to exploit this vulnerability?
The attacker can target the vulnerable Microsoft Edge (Chromium-based) remotely without privileges or complex attack conditions, but exploitation requires user interaction.
2
What is the potential impact if exploitation succeeds?
Successful exploitation can allow unauthorized remote code execution and may affect confidentiality, integrity, and availability.
3
How urgent is remediation?
This issue is rated high severity with a CVSS score of 8.8. The provided data does not identify affected versions or available mitigations, so use the Microsoft advisory reference to determine applicable updates.