Advisory · CVE-2026-85898
Type confusion in Microsoft Edge can execute code over a network
Microsoft Edge (Chromium-based) before 154.0.4258.48 contains a type confusion flaw that allows an unauthorized attacker to execute code over a network when a user interacts with malicious content. CVSS 3.1 8.8.
- Vendor
- Microsoft
- Product
- Microsoft Edge (Chromium-based)
- Identifier / CWE
- CVE-2026-85898
CWE-843 - Action timing
- Immediate
Explain it like I’m five
The browser mistakes one kind of object for another and treats it with the wrong rules. A crafted page can use that mix-up to reach memory it should never touch and run code.
- 01Victim visits content
The victim opens a page carrying the attack content in an affected Edge build.
- 02Type confusion triggers
The browser accesses a resource with a type incompatible with the resource actually in use.
- 03Memory access goes wrong
Operations land on the wrong object layout, corrupting execution state.
- 04Code executes
The attacker executes code in the browser context over the network attack path.
What happened
Microsoft published CVE-2026-85898 in NVD on October 27, 2026, rating it high at CVSS 3.1 8.8: access of a resource using an incompatible type, or type confusion (CWE-843), in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. The vector in the record requires user interaction, consistent with a victim visiting attacker content.
Microsoft lists Microsoft Edge (Chromium-based) versions before 154.0.4258.48 as affected, so 154.0.4258.48 is the fixed build in the record.
What to do
- Inventory Microsoft Edge installations across managed endpoints and note the version of each.
- Update Edge to 154.0.4258.48 or later, and force a browser restart so the new build is actually running.
- Until endpoints are updated, reinforce standard web protections and remind users that unexpected browser crashes after visiting a site should be reported.
- Review endpoint telemetry for Edge crash clusters or child processes spawned by the browser.
- Verify the running version after updating, including on shared and kiosk machines.
Management note
Browser memory flaws are commodity exploit material. Keep Edge on the automatic update ring and audit restart compliance, because an updated-but-not-restarted browser is still the old browser.