CVE-2026-66321: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Details
Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66321
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-66321 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Microsoft Edge
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownMicrosoft Edge Multiple Vulnerabilitieshkcert · 2026-08-03
- medium[NEW] [medium] Microsoft Edge for Android: Vulnerability allows disclosure and manipulation of filescert-bund · 2026-07-29
- unknownMultiple Vulnerabilities in Microsoft Edge (July 29, 2026)cert-fr-avis · 2026-07-29
- mediumCVE-2026-62828: Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to per…nvd · 2026-07-28
- medium[NEW] [medium] Microsoft Edge: Multiple vulnerabilities allow information disclosure and spoofing attackscert-bund · 2026-07-27
- unknownMicrosoft Edge Multiple Vulnerabilitieshkcert · 2026-07-27
More from Microsoft Security Response Center
- highCVE-2026-57992: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability2026-07-14
- mediumCVE-2026-59926: Mistune: XSS via unescaped class option in Admonition directive2026-07-14
- mediumCVE-2026-55003: Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability2026-07-14
- highCVE-2026-42900: Microsoft Windows App Store Elevation of Privilege Vulnerability2026-07-14
- unknownCVE-2026-13867: Chromium: CVE-2026-13867 Inappropriate implementation in Geolocation2026-07-14