CVE-2026-66321 is a type confusion flaw in Microsoft Edge (Chromium-based), scored 7.4. Microsoft's record says an unauthorized attacker could execute code over a network, with user interaction. Update Edge to the latest build and confirm the fixed version in Microsoft's advisory.
What's affected
- Product: Microsoft Edge (Chromium-based).
- Weakness: CWE-843 access of resource using incompatible type, known as type confusion.
- Severity: CVSS 3.1 7.4, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. The user has to take an action, such as visiting a page. - Fixed version: not confirmed. Microsoft's page needs JavaScript and did not load for me, so check it for the fixed Edge build.
How to check if you're exposed
Open edge://version in the browser and read the version number. Edge updates itself, so most machines should already be current, but managed machines can have updates paused or deferred.
For a fleet, use your endpoint management tool to list the Edge version per device and compare it with the fixed build in Microsoft's advisory. Look for machines that have been off for a long time, kiosk systems, and virtual desktop images that were built months ago.
What to do now
- Read the Microsoft advisory for CVE-2026-66321 and note the fixed Edge build.
- Check that Edge update policies are not holding machines back.
- Update Edge on every device, and restart the browser so the new version is active.
- Update golden images for virtual desktops and kiosks.
- Verify a sample of machines with edge://version.
Why it matters
Type confusion happens when code treats a piece of memory as one type of object while it is actually another. In a browser engine that mistake can let a web page read or write memory it should not touch, which is a common first step towards running code.
The vector requires user interaction, so the attacker needs a person to open a page. That is easy to arrange on the web. Microsoft's record does not report exploitation and the CISA KEV flag is false. Browser fixes are one of the easier problems to solve, because the update is small and automatic when it is allowed to run.
Quick check
How do I know I have the fix?
Compare the version at edge://version with the fixed build named in Microsoft's advisory. I could not read that number from the page.
Do other Chromium browsers share this?
The record names only Microsoft Edge. Check your other browser vendors separately.
Sources
- Microsoft Security Response Center entry (listed in the record; its page needs JavaScript, so I could not read build numbers from it)
- Gold record for CVE-2026-66321
Last reviewed: 19 October 2026.
