Skip to main content
VulnerabilityPublished

CVE-2026-85897: Microsoft Edge (Chromium-based) · Heap-based Buffer Overflow

Affects Microsoft Edge (Chromium-based)Source CVE Database V5

0
Compare

Not known to be exploited · CVSS 8.8 High : upgrade to 154.0.4258.37 soon.

Data as of 29 Oct 2026, 15:23 UTC

CVSS 3.1 base score
8.8High
How severe the flaw is on the 0–10 CVSS scale.

Thin evidence

One scorer or none
CVSS scores by source
CNA (microsoft)CVSS 3.18.8
Patch
Available – fixed in 154.0.4258.37
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 29 Oct 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

What to do

Upgrade Microsoft Edge (Chromium-based) to 154.0.4258.37.

Affected software

ProductAffectedFixed in
MicrosoftMicrosoft Edge (Chromium-based)Affected
  • >=1.0.0.0 <154.0.4258.37
Fixed in
  • 154.0.4258.37

Description

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

References

Community reviews

Loading reviews…