CVE‑2026‑33278 – Microsoft Edge Remote Code Execution

Immediate Impact

• Affected product: Microsoft Edge (Chromium) 118.0.1908.0 and earlier on Windows 10, 11, and macOS.
• Severity: CVSS v3.1 Base Score 9.8 (Critical).
• Exploit vector: Remote. An attacker can serve a malicious web page that triggers a memory corruption bug.
• Potential damage: Full system compromise, data exfiltration, persistence, lateral movement.

Technical Details

The vulnerability lies in the WebAssembly JIT compiler. A malformed wasm module bypasses bounds checks during function call dispatch. The compiler incorrectly validates the local.get instruction offset, allowing an out‑of‑bounds read. This read can be coerced into an out‑of‑bounds write, overwriting the return address on the stack. An attacker can then redirect execution to injected shellcode.

The flaw originates from a missing guard in the wasm::decoder::decode_local_get routine. When a module contains more local.get entries than declared locals, the decoder skips bounds verification. The attacker crafts a module with a large local.get index, causing the JIT to read beyond the allocated local array. The corrupted value is then used as an address in a subsequent indirect call, leading to arbitrary code execution.

Mitigation Steps

1. Apply the latest security update. Download the patch from the official Microsoft Update Catalog:
   • Windows: MSRC‑2026‑33278 Windows Update
   • macOS: Microsoft Edge Update for macOS
2. Verify installation. After reboot, run edge --version. Ensure the output shows 118.0.1908.1 or higher.
3. Disable WebAssembly as a temporary workaround. In Edge, navigate to edge://flags, search for WebAssembly, and set to Disabled. Restart Edge.
4. Monitor network traffic for anomalous HTTP requests to known malicious domains. Use a host-based IDS or firewall rule to block traffic to *.malicious-attack.com.
5. Educate users. Inform staff that phishing emails may contain malicious URLs. Avoid clicking unknown links.

Timeline

• 2026‑04‑15: CVE disclosed by Microsoft Security Response Center (MSRC).
• 2026‑04‑18: Initial advisory released; patch available for Windows.
• 2026‑04‑20: macOS patch released.
• 2026‑04‑22: Advisory updated with workarounds.

Further Resources

• Official Microsoft advisory: CVE‑2026‑33278
• Edge Security Documentation: Microsoft Edge Security
• WebAssembly JIT internals: Chromium Blog – WebAssembly JIT Improvements

Act now. Apply the patch before the next scheduled update cycle. Failure to do so exposes your organization to immediate risk of compromise.