This vulnerability in Microsoft Edge (Chromium-based) is caused by type confusion, where the software accesses a resource using an incompatible type. This flaw can be exploited by an attacker over a network to execute arbitrary code with elevated impact on integrity and limited impact on confidentiality and availability. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with high complexity and requiring user interaction. Microsoft has published an official fix to address this issue.

Successful exploitation allows remote attackers to execute arbitrary code on affected systems, potentially compromising system integrity and causing limited confidentiality and availability impacts. The vulnerability requires user interaction and has high attack complexity, reducing the likelihood of widespread exploitation. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58290 to remediate this vulnerability.