Use-after-free in Microsoft Edge - CVE-2026-66798

Vulnerability details

The vulnerability allows a remote attacker to execute code.

The vulnerability exists due to use-after-free in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content. A remote attacker can host a malicious webpage and induce the victim to visit it to execute code.

User interaction is required, including visiting an attacker-controlled webpage and performing two tap gestures that cause autofill to activate.

Affected software

How to mitigate CVE-2026-66798

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-66798
• https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Edge