CVE-2026-66798: CWE-416: Use After Free in Microsoft Microsoft Edge (Chromium-based)

This vulnerability (CVE-2026-66798) involves a use-after-free condition in Microsoft Edge (Chromium-based). Exploitation could allow an attacker to execute code remotely over a network. The affected versions are all releases starting from 1.0.0.0 up to but excluding 152.0.4191.52. The CVSS 3.1 base score is 4.3, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and user interaction required. Microsoft has published an official fix for this vulnerability.

An attacker could remotely execute code by exploiting the use-after-free vulnerability in affected versions of Microsoft Edge. The impact is limited to availability (denial of service or crash) as confidentiality and integrity impacts are not indicated. No known exploits are currently reported in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security update for Microsoft Edge (Chromium-based) to versions 152.0.4191.52 or later to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66798 for detailed update instructions.