Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over

Microsoft Edge2026-10-27 21:19 UTC1 min readRead in

Summary

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Remediation

Inventory every Microsoft Edge deployment, including staging.
Upgrade Microsoft Edge to 154.0.4258.48.
Confirm the running version after the upgrade.

References

Patchhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85898

CVSS vector

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected versions

Version	Fixed in
– <154.0.4258.48	154.0.4258.48

Weakness

CWE-843

Exploit probability (EPSS)

0.8%

Timeline

2026-10-27Publicly disclosed

Sources

NVD