CVE-2026-85897: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Published Oct 16, 2026
·Updated
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Other sources
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
— Microsoft
Affected Software
3 affected componentsFixes available
Microsoft Edge (Chromium-based)<154.0.4258.37
154.0.4258.37
Microsoft Edge<154.0.4258.37
154.0.4258.37
Microsoft Edge Chromium<154.0.4258.37
Remediation
Event History
Oct 16, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
Oct 29, 2026
CVE Published
via MITRE·03:09 PM
Data Sourced
via MITRE·03:09 PM
DescriptionSeverity
Data Sourced
via NVD·04:19 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What must an attacker do to exploit this vulnerability?
The attacker can target Microsoft Edge over a network without prior privileges, but exploitation requires user interaction. Successful exploitation can result in remote code execution.
2
What is the potential impact if exploitation succeeds?
The vulnerability has high confidentiality, integrity, and availability impacts. An attacker who successfully exploits it could execute code in the context enabled by the affected Edge process.
3
Is this known to be exploited in the wild?
The provided data lists exploitation status as unknown. It does not confirm active exploitation.