CVE-2026-85893
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
A use-after-free vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. The vulnerability is remotely exploitable.
Risk Assessment
It enables a remote attacker to execute code in the user's browser context, potentially leading to session takeover or workstation compromise. The risk affects users browsing malicious sites.
Recommendation
Update Microsoft Edge to the latest fixed version. Enforce browser updates across the organization.
Other vulnerabilities in Microsoft Edge
See all- CVE-2017-11861High
A vulnerability in the Microsoft Edge scripting engine in Windows 10 and Windows Server allows an attacker to gain the same user rights as the current user due to improper handling of objects in memory.
- CVE-2017-11845High
A vulnerability in Microsoft Edge on Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user due to improper handling of objects in memory.
- CVE-2017-11800High
Microsoft Edge in Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to how the scripting engine handles objects in memory.
- CVE-2017-11798High
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.
- CVE-2017-8757High
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way Microsoft Edge handles objects in memory.
- CVE-2017-8756High
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way Microsoft Edge accesses objects in memory.
- CVE-2017-8755High
Microsoft Edge in Windows 10 (1511, 1607, 1703) and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way the scripting engine handles objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.
- CVE-2017-8752High
Microsoft Edge in Windows 10 (1511, 1607, 1703) and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way the Microsoft Edge scripting engine handles objects in memory.
- CVE-2017-8751High
A vulnerability in Microsoft Edge in Windows 1703 allows an attacker to execute arbitrary code in the context of the current user due to the way Microsoft Edge accesses objects in memory.
- CVE-2017-8740High
Microsoft Edge in Windows 10 version 1703 allows an attacker to execute arbitrary code in the context of the current user due to the way the Microsoft Edge scripting engine handles objects in memory.
Original NVD description (English source)
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS