CVE-2026-66312 is a medium severity (CVSS 6.5) buffer over-read in Microsoft Edge (Chromium-based). Microsoft lists version 151.0.4129.59 as fixed and titles the entry a remote code execution vulnerability. Update Edge to that version or later and confirm the version after the browser restarts.
What's affected
The record describes a buffer over-read (CWE-126) in Microsoft Edge (Chromium-based) that allows an authorized attacker to execute code over a network. Microsoft's update guide lists Microsoft Edge (Chromium-based) with fixed version 151.0.4129.59, released on 31 July 2026 on Chromium 151.0.7922.71 or .72.
Microsoft's scoring is 6.5 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. That matches the record. Note a quirk in the data: the entry is titled remote code execution, but the vector rates confidentiality impact only, with no integrity or availability impact. Microsoft's FAQ says any authenticated attacker could trigger it without admin rights.
The two signals do not fully agree. Read the title as the vendor's classification and the vector as its scoring, and plan around the stricter reading by updating promptly.
How to check if you're exposed
Open edge://settings/help in Edge. The page shows the installed version and triggers an update check. A version below 151.0.4129.59 is behind the fix.
For managed Windows, macOS and Linux fleets, read the browser version from your endpoint management tool and compare it. Edge updates itself in the background, but machines that stay open for weeks or run old policy can lag behind, so a version report is worth the effort.
What to do now
- Report Edge versions across your devices.
- Update to 151.0.4129.59 or later, and restart the browser so the update applies.
- Check your update policy for deferrals that hold Edge back.
- Apply the same update to embedded copies of Edge, such as kiosk or virtual desktop images.
- Check the update guide entry for any revision.
Why it matters
A buffer over-read happens when code reads past the end of a memory buffer. The data it reads comes from nearby memory, which can include things the program never meant to expose. In a browser that memory may hold content from other pages.
The browser is among the most exposed pieces of software on any device, since it processes untrusted content all day. That is why even a medium score gets a fast patch. The fix is small and the update is automatic for most users.
Microsoft marks it as not publicly disclosed and not exploited at release, with exploitation unlikely. The record's KEV flag is false.
Quick check
Why is a medium score titled remote code execution?
Microsoft's title and its vector differ. The vector shows only confidentiality impact. Patch on the stricter reading anyway.
How do I know the fix applied?
Check edge://settings/help for 151.0.4129.59 or later after a restart.
Sources
- Microsoft Security Response Center update guide entry for CVE-2026-66312
- NVD record for CVE-2026-66312
Last reviewed: 18 October 2026.
