Microsoft Edge Patches CVSS 8.8 Type Confusion RCE
Microsoft patched eight Edge CVEs in late August, led by CVE-2026-72984, a CVSS 8.8 type confusion flaw enabling unauthenticated remote code execution over a network.
Marisol "Fuse" DelgadoMicrosoft shipped a security update for Edge (Chromium-based) on August 28 covering eight vulnerabilities. The lead flaw, CVE-2026-72984, is a type confusion vulnerability rated CVSS 8.8 that allows an unauthenticated remote attacker to execute code over a network. No active exploitation has been confirmed, but type confusion flaws in Chromium-based engines have a reliable track record of reaching CISA’s KEV catalog. Do not sit on this one.
Update Edge now. Go to Settings, then Help, then About Microsoft Edge. That is the full action item.
What Got Patched
Eight CVEs across Edge and its integrated Copilot Chat component:
| CVE | CVSS | Type | Impact | Component |
|---|---|---|---|---|
| CVE-2026-72984 | 8.8 (High) | Type confusion | RCE | Edge (Chromium) |
| CVE-2026-66798 | 4.3 (Medium) | Use after free | RCE | Edge (Chromium) |
| CVE-2026-66324 | 6.5 (Medium) | File path control | Spoofing | Edge (Chromium) |
| CVE-2026-66323 | 5.4 (Medium) | Argument injection | RCE | Edge (Chromium) |
| CVE-2026-70309 | 5.4 (Medium) | Origin validation error | Security bypass | Edge (Chromium) |
| CVE-2026-62904 | 5.4 (Medium) | Incorrect authorization | Info disclosure | Edge (Chromium) |
| CVE-2026-70331 | 5.4 (Medium) | LLM prompt injection | Spoofing | Edge for iOS |
| CVE-2026-58616 | 4.4 (Medium) | Race condition | Info disclosure | Copilot Chat (Edge) |
Source: Microsoft Security Response Center advisories.
Priority Call
CVE-2026-72984 is the one to move on first. Type confusion vulnerabilities that allow unauthenticated, network-based code execution are the category researchers weaponize fastest. The CVSS 8.8 rating reflects that: no local access, no authentication required.
CVE-2026-66323 (argument injection, also rated RCE) and CVE-2026-66798 (use-after-free) are medium severity on paper but worth flagging for enterprise teams running Edge in managed environments. Multiple RCE-class bugs in a single update wave is not a quiet month.
Two entries in this batch stand out for different reasons:
CVE-2026-70331 is an LLM prompt injection flaw in Edge for iOS. The attack vector is spoofing over a network, meaning a malicious site or content could manipulate Edge’s AI prompting layer to misrepresent information to the user. If your organization manages iOS devices with Edge deployed, check that mobile update policies are active and current.
CVE-2026-58616 is a race condition in Copilot Chat inside Edge. The classified attacker here is an authorized user, so the threat model is more about lateral info disclosure than external attack, but it underscores that Copilot’s integration surface inside the browser is still being worked through from a security standpoint.
What to Do
- Personal devices: Update Edge through About Microsoft Edge. The update applies automatically on most configurations, but confirm the version is current.
- Enterprise deployments: Verify your Edge update policies in Intune or Group Policy are enforcing the latest stable channel. Chromium-based engines move fast; patch lag measured in days is long enough for proof-of-concept work to circulate.
- iOS fleets: Confirm Edge for iOS updates are included in your mobile device management policy scope, specifically for CVE-2026-70331.
There is no known workaround for CVE-2026-72984. Update is the only mitigation.
Related Coverage
Found this useful? Share it.
