Microsoft Edge Remote Code Execution Vulnerability (CVE‑2026‑46086)

Immediate Impact

• Affected product: Microsoft Edge (Chromium‑based) versions 110.0.1587.54 through 112.0.1722.48 on Windows, macOS, and Linux.
• Severity: CVSS v3.1 base score 9.8 (Critical). Attackers can run arbitrary code with the privileges of the current user.
• Exploitability: Remote. No user interaction required if the user visits a malicious site or opens a crafted file.
• Timeline: Vulnerability discovered on 2026‑04‑12. Microsoft released a security patch on 2026‑04‑25.

Technical Details

CVE‑2026‑46086 stems from an unchecked pointer dereference in the Edge renderer process. When a specially crafted HTML file containing a malformed <script> tag is loaded, the renderer crashes and falls back to a legacy JavaScript engine. The legacy engine incorrectly parses the src attribute, allowing an attacker to inject arbitrary JavaScript that is executed with full renderer privileges. Because the renderer shares memory with the browser process, the injected code can spawn a native process, read files, or modify system settings.

The flaw exists in the ScriptEngine::ParseAttributes routine, where bounds checking is omitted for the src string. The missing check permits an out‑of‑bounds read, leading to a memory corruption that the legacy engine interprets as executable code. This bypasses the sandbox enforced by the renderer, granting the attacker full access to the user’s profile and data.

Why It Matters

• Privilege escalation: The code runs with the same rights as the logged‑in user, enabling credential theft or ransomware deployment.
• Persistence: Malicious code can install a backdoor, survive reboots, and evade standard antivirus detection.
• Wide reach: Edge is the default browser on Windows 11 and many enterprise deployments, increasing the attack surface.

Mitigation Steps

1. Apply the patch immediately. Download the latest cumulative update from the Microsoft Security Update Guide or update via Windows Update.
2. Disable Edge temporarily if a system cannot be patched immediately. Use an alternative browser such as Firefox or Chrome.
3. Block malicious URLs. Deploy a web filter that blocks known malicious domains until the patch is applied.
4. Monitor for suspicious activity. Use endpoint detection and response (EDR) tools to flag unusual process creation or file access patterns.
5. Verify integrity. After patching, run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth to ensure system files are intact.

Long‑Term Recommendations

• Enable automatic updates for all Microsoft products. Configure Group Policy to enforce Windows Update for all users.
• Implement least‑privilege browsing. Restrict Edge to a sandboxed profile for non‑admin users.
• Regularly audit browser extensions. Remove or disable any that are not essential.
• Stay informed. Subscribe to the Microsoft Security Advisory RSS feed for future alerts.

Useful Resources

• Microsoft Security Update Guide – CVE‑2026‑46086
• Edge Release Notes
• Windows Update Documentation
• EDR Best Practices

Act now. The vulnerability is actively exploited in the wild. Apply the patch before the next update cycle to protect your organization.