CVE-2026-70341 is a high severity (CVSS 8.5) use after free in Microsoft Edge (Chromium-based). An authorized attacker could execute code over a network. The fix is to update Edge to the build named in the Microsoft Security Response Center entry and restart the browser so the update takes effect.
What's affected
The record names Microsoft Edge (Chromium-based) and lists Apple macOS and the Linux kernel among the platform entries, which fits a browser that ships on Windows, macOS and Linux. It does not give version numbers.
The weakness is CWE-416. The vector is AV:N/AC:H/PR:L/UI:N/S:C: network reachable, high complexity, low privileges, and a changed scope, with high impact on confidentiality, integrity and availability. Changed scope means a successful attack can affect resources beyond the vulnerable component, as with a browser sandbox escape.
I could not read the MSRC page, so confirm the fixed Edge version there.
How to check if you're exposed
Browsers update themselves, but only when they restart. Check the installed version on a sample of machines.
In Edge, open edge://settings/help. The page shows the version and starts an update check. On managed fleets, query the version through your endpoint tool instead. On Linux:
microsoft-edge --version
Compare with the fixed build in MSRC. Long running sessions on kiosks and shared desktops are the usual stragglers, because the browser may stay open for days after the update installs.
For teams that build products on Chromium, such as Electron apps, the question is different: which Chromium version does your app bundle. free in-browser dependency scan lists known vulnerabilities for components in your manifest.
What to do now
- Open the MSRC entry for CVE-2026-70341 and note the fixed Edge version.
- Check the installed Edge version on managed machines and report any that are behind.
- Force the update through your management tool and require a browser restart.
- Check kiosks and shared machines that keep a browser open for long periods.
- If you ship an Electron or Chromium based application, confirm the Chromium version it bundles.
Why it matters
CWE-416 is use after free: the program releases a block of memory and later uses it again. If an attacker can influence what occupies that memory in between, they can steer the program. Browsers are large C++ programs that handle untrusted content all day, so this class recurs.
The high attack complexity lowers the score a little, but the changed scope and high impacts keep it high. The practical answer is routine: keep browsers updated, and treat a pending restart as an unpatched system.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is a restart part of the fix?
Edge downloads updates in the background, but the running process keeps using the old code until the browser restarts. Until then the vulnerable build is still in use.
Sources
Last reviewed: 18 October 2026.
