Skip to main content
VulnerabilityPublished

CVE-2026-85897: Microsoft Edge (Chromium-based) · Heap-based Buffer Overflow

Affects Microsoft Edge (Chromium-based)Source CVE Database V5

0
Compare

Not known to be exploited · CVSS 8.8 High : upgrade to 154.0.4258.37 soon.

Data as of 29 Oct 2026, 15:38 UTC

CVSS 3.1 base score
8.8High
How severe the flaw is on the 0–10 CVSS scale.

Thin evidence

One scorer or none
CVSS scores by source
CNA (microsoft)CVSS 3.18.8
Patch
Available – fixed in 154.0.4258.37
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 29 Oct 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

What to do

Upgrade Microsoft Edge (Chromium-based) to 154.0.4258.37.

Affected software

ProductAffectedFixed in
MicrosoftMicrosoft Edge (Chromium-based)Affected
  • >=1.0.0.0 <154.0.4258.37
Fixed in
  • 154.0.4258.37

AI-suggested

An official fix is available from Microsoft in version 154.0.4258.37 of Microsoft Edge (Chromium-based). Users and administrators should update to this version or later to remediate the vulnerability. Since the fix is official and available, no additional mitigation steps are required.

Description

CVE-2026-85897 is a heap-based buffer overflow vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely over a network. The flaw affects versions from 1.0.0.0 up to but not including 154.0.4258.37. Microsoft has released an official fix in version 154.0.4258.37 to address this issue. The vulnerability has a high severity rating with a CVSS score of 8.8. No known exploits are reported in the wild at this time.

References

Community reviews

Loading reviews…