CVE-2026-72970 is a heap-based buffer overflow vulnerability in Microsoft Edge (Chromium-based) that enables remote code execution by an unauthorized attacker. The vulnerability has a CVSS 3.1 score of 8.3, indicating high impact with network attack vector, low attack complexity, no privileges required, but user interaction needed. The flaw is categorized under CWE-122 (Heap-based Buffer Overflow). No patch or remediation information is currently available, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker to execute arbitrary code on the affected system remotely, potentially leading to full compromise of the user environment. The vulnerability impacts confidentiality, integrity, and availability with high confidentiality and integrity impact and low availability impact as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted content in Microsoft Edge and follow any security recommendations from Microsoft.