Advisory · CVE-2026-83831
Double free in Microsoft Edge can execute code over a network
Microsoft Edge (Chromium-based) before 154.0.4258.48 contains a double free that allows an unauthorized attacker to execute code over a network when a user interacts with malicious content. CVSS 3.1 8.8.
- Vendor
- Microsoft
- Product
- Microsoft Edge (Chromium-based)
- Identifier / CWE
- CVE-2026-83831
CWE-415 - Action timing
- Immediate
Explain it like I’m five
The browser frees the same piece of memory twice, which scrambles its bookkeeping. A crafted page can steer that confusion into running the attacker's code inside the browser.
- 01Victim visits content
The victim opens a page carrying the attack content in an affected Edge build.
- 02Double free triggers
The browser frees the same memory twice while handling the content.
- 03Memory corrupts
The corrupted allocator state gives the attacker control over subsequent memory use.
- 04Code executes
The attacker executes code in the browser context over the network attack path.
What happened
Microsoft published CVE-2026-83831 in NVD on October 27, 2026, rating it high at CVSS 3.1 8.8: a double free (CWE-415) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. The vector in the record requires user interaction, consistent with a victim visiting attacker content.
Microsoft lists Microsoft Edge (Chromium-based) versions before 154.0.4258.48 as affected, so 154.0.4258.48 is the fixed build in the record.
What to do
- Inventory Microsoft Edge installations across managed endpoints and note the version of each.
- Update Edge to 154.0.4258.48 or later, and force a browser restart so the new build is actually running.
- Until endpoints are updated, reinforce standard web protections and remind users that unexpected browser crashes after visiting a site should be reported.
- Review endpoint telemetry for Edge crash clusters or child processes spawned by the browser.
- Verify the running version after updating, including on shared and kiosk machines.
Management note
Browser memory flaws are commodity exploit material. Keep Edge on the automatic update ring and audit restart compliance, because an updated-but-not-restarted browser is still the old browser.