CVE-2026-85897: Microsoft Edge (Chromium-based) · Heap-based Buffer Overflow
Affects Microsoft Edge (Chromium-based)Source CVE Database V5
Not known to be exploited · CVSS 8.8 High : upgrade to 154.0.4258.37 soon.
Data as of 29 Oct 2026, 15:38 UTC
Thin evidence
One scorer or none| CNA (microsoft) | CVSS 3.1 | 8.8 |
|---|
- Patch
- Available – fixed in 154.0.4258.37
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:CExploitation evidence
Disclosed: evidence found.
CVE published 29 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.
What to do
Upgrade Microsoft Edge (Chromium-based) to 154.0.4258.37.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| MicrosoftMicrosoft Edge (Chromium-based) | Affected
| Fixed in
|
AI-suggested
An official fix is available from Microsoft in version 154.0.4258.37 of Microsoft Edge (Chromium-based). Users and administrators should update to this version or later to remediate the vulnerability. Since the fix is official and available, no additional mitigation steps are required.
Description
CVE-2026-85897 is a heap-based buffer overflow vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely over a network. The flaw affects versions from 1.0.0.0 up to but not including 154.0.4258.37. Microsoft has released an official fix in version 154.0.4258.37 to address this issue. The vulnerability has a high severity rating with a CVSS score of 8.8. No known exploits are reported in the wild at this time.