CVE-2026-58289 (CVSS 9.0) — Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

A critical vulnerability has been published under CVE-2026-58289, affecting Microsoft Edge (Chromium-based) with a CVSS score of 9.0. The flaw is a type confusion vulnerability, meaning the browser incorrectly handles data types, which could allow an unauthorized attacker to execute arbitrary code remotely over a network. This was published on July 3, 2026, by the National Vulnerability Database and requires immediate attention.

Any organization using Microsoft Edge as a primary browser is affected, particularly those in regulated sectors such as finance, healthcare, and government where data integrity and network security are paramount. Because the attack vector is network-based and requires no user interaction, all endpoints running Edge are at risk, including remote and hybrid work environments.

Compliance teams should immediately verify that Microsoft’s security patch for this CVE is applied across all managed devices. Update your vulnerability management and patching schedules to prioritize this fix. Additionally, review your incident response plans to account for potential exploitation via browser-based attacks, and ensure that network segmentation and least-privilege access controls are in place to limit lateral movement if an endpoint is compromised.