CVE-2026-70341

CVE-2026-70341 is a use-after-free memory-safety flaw (CWE-416) in Microsoft Edge's Chromium-based browser, rated 8.5 (High) with a network attack vector and high attack complexity. An authorized attacker — one who already holds some low level of privilege or access per the PR:L metric — can trigger the bug remotely with no user interaction required. Successful exploitation yields arbitrary code execution with high impact on confidentiality, integrity, and availability, and the changed-scope metric (S:C) indicates the impact can extend beyond the vulnerable component's normal security boundary. All deployments of Chromium-based Microsoft Edge that lack the fix are potentially affected; the available data does not specify affected or fixed build numbers. As of now the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known, so there is no confirmed active exploitation.

What to do: Update Microsoft Edge to the current stable-channel release incorporating the fix for this CVE as soon as Microsoft's advisory identifies the fixed build, and verify the update landed by checking edge://version. No workarounds are documented in the available data; since there is no known exploitation or public PoC, this can be handled within normal patch cycles, but the high CVSS score warrants prompt patching. Monitor Microsoft's advisory for the specific fixed version and any changes in exploitation status.