Use-after-free in Microsoft Edge - CVE-2026-66315
Published: July 31, 2026 / Updated: August 2, 2026
Vulnerability identifier: #VU140716
CSH Severity: Medium
CVSS v4 BT: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2026-66315
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to use-after-free in Microsoft Edge (Chromium-based) when processing crafted web content. A remote attacker can trick the victim into visiting an attacker-controlled webpage and performing crafted interactions to execute arbitrary code.
User interaction is required, and successful exploitation requires the user to perform two sequential taps that activate autofill.
Affected software
Microsoft Edge
How to mitigate CVE-2026-66315
Install security update from vendor's website.
Microsoft Edge - update to 151.0.4129.59