CVE-2026-85890

Microsoft: double free

Risk score: 63/100
CVSS: 8.8 v3.1
Published: 16 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: A double free vulnerability in Microsoft Edge (Chromium-based) allows an attacker to execute code over a network, potentially leading to code execution.
Affected: {'products': ['Microsoft Edge (Chromium-based)'], 'packages': [], 'versions': []}
Fix: Check the linked advisory for details on the fix.
Exploitation: No known exploitation

Why it is Amber

CVSS 8.8 high
Remotely exploitable without logging in
Named in a government or vendor bulletin

Government and vendor bulletins

CVE-2026-85890 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85890

Original description

Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Last activity 29 Oct 2026. Patch Forecast updates every hour.