Use-after-free in Microsoft Edge enables remote code execution

Use-after-free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.

• Microsoft Edge (Chromium-based): versions starting at 1.0.0.0 and less than 152.0.4191.52 are marked affected.
• Microsoft Edge for Android: versions starting at 1.0.0.0 and less than 152.0.4191.52 are marked affected.
• Microsoft Edge for iOS: versions starting at 1.0.0.0 and less than 152.0.4191.52 are marked affected.
• Microsoft Edge for Linux: versions starting at 1.0.0 and less than 152.0.4191.52 are marked affected.
• Microsoft Edge for MAC: versions starting at 1.0.0.0 and less than 152.0.4191.52 are marked affected.

Microsoft's advisory release information lists 152.0.4191.53 and 152.0.7977.64/.65, but the returned evidence does not map each value to a specific platform. Verify the applicable package for each branch rather than assuming that one release value remediates every deployment.

Microsoft classifies this as CWE-416, where an object is accessed or used after it has been released. The advisory states that an attacker who already has the ability to execute JavaScript in the affected Microsoft Edge process could trigger the flaw through specially crafted activity. Successful exploitation could allow code execution beyond the browser's security scope. The record describes network reachability, low required privileges, and no user interaction, while Microsoft's advisory adds the precondition of existing JavaScript execution in the affected process. Five product families are listed as affected, but the public material does not identify the specific subsystem, function, or activity that creates the use-after-free condition.

The flaw is reachable over a network, and the record describes an authorized attacker with low required privileges. The record does not require user interaction, while Microsoft states that the attacker must already be able to execute JavaScript in the affected Edge process and must create specially crafted activity, making the precondition nontrivial. Microsoft states that the vulnerability was not publicly disclosed and was not exploited at the time of its advisory, and rates exploitation against the latest software release as unlikely. That is a time-scoped status from the advisory and does not prove that exploitation will not occur later. No public exploit or named campaign is identified in the sources reviewed.

Exploitation of the use-after-free could result in code execution beyond the browser's security scope. The technical outcome could affect the confidentiality, integrity, and availability of data or endpoints accessible to the compromised process. Because the record describes an authorized attacker and Microsoft requires existing JavaScript execution in the affected process, the flaw is not described as an attack path requiring no prior capability. Actual impact depends on process privileges, data available within the Edge session, and endpoint isolation controls. Public details do not establish the precise privilege escalation or post-exploitation behavior.

Successful exploitation could weaken the browser security boundary and permit code execution outside the expected browser scope. Depending on the privileges of the affected process and the data accessible to the browser, consequences could include disclosure or modification of information and disruption of the endpoint. Operational impact includes prioritizing updates across multiple platforms and verifying that each platform received the correct package for its release branch. The record provides no evidence of a specific compromise, victim, or campaign.

1. Update immediately: deploy the Microsoft Edge update applicable to each platform through the official update channel. Microsoft's advisory lists 152.0.4191.53 and 152.0.7977.64/.65 in its release information; verify which value applies to each branch before broad deployment.
2. Inventory Edge installations on desktop, Android, iOS, Linux, and macOS, then confirm that each endpoint received the correct update package and no longer falls within the affected boundary.
3. If immediate updating is not possible, reduce access to untrusted web content and limit untrusted JavaScript execution where that is practical under organizational policy. This is a temporary risk-reduction measure, not a Microsoft-confirmed fix.
4. Monitor Microsoft advisories and update channels for branch-specific changes or additional platform guidance. Do not treat a release identified for one branch as evidence that every other branch has been fixed.

1. Inventory Microsoft Edge across workstations and mobile devices, including deployments on Android, iOS, Linux, and macOS.
2. Compare installed versions with the affected boundary in affected_summary and verify update status through endpoint management or the Edge update channel.
3. Review each platform separately rather than assuming that one release value applies to every product branch.
4. Review endpoint telemetry for unusual browser-process activity and code execution outside the browser security scope. Treat this as precautionary monitoring, not as a Microsoft-confirmed indicator.
5. The reviewed sources do not provide a specific IOC, log event, or detection signature for this vulnerability.