Microsoft Edge Vulnerability CVE‑2026‑118330 Use‑After‑Free in Chromium Engine

What happened

In early 2026, a use‑after‑free flaw was identified in the Chromium rendering engine. The defect originates in the handling of a specific JavaScript object that can be freed while still referenced by a pending task queue. When an attacker triggers the flaw, the browser may read or write memory that has already been reclaimed, potentially leading to arbitrary code execution or denial‑of‑service conditions.

The vulnerability was assigned CVE‑2026‑118330 by the Chromium project and subsequently incorporated into the Microsoft Edge (Chromium‑based) release channel. Edge users are therefore exposed to the same risk until a patch is deployed.

Who is affected

All users running Microsoft Edge on Windows, macOS, Linux, iOS, or Android that have not applied the latest security update are at risk. The issue affects every edition of Edge that includes the Chromium engine, including the stable, beta, and dev channels.

Organizations that rely on Edge for internal web applications, remote desktop access, or browser‑based workflows should consider the vulnerability a priority, as the flaw can be triggered from a malicious web page or a compromised site.

Impact

Because the flaw is a use‑after‑free, the severity depends on the context in which the freed memory is reused. In the worst case, an attacker could execute arbitrary code with the privileges of the browser process, which may include access to user data, credentials, or the ability to pivot to other systems.

Even if code execution is not achieved, the vulnerability can cause a crash, leading to a denial‑of‑service that disrupts user productivity and can be leveraged in a broader attack chain.

Exposure

Exploitability requires a malicious web page that can be opened in Edge. An attacker can embed the payload in an email attachment, a compromised website, or a phishing link. Once the page is rendered, the JavaScript engine triggers the use‑after‑free by manipulating the object lifecycle.

Because the flaw resides in the core rendering engine, it is not limited to a single feature; any site that can load arbitrary JavaScript can potentially trigger the defect.

What to do

• Verify that Edge is updated to the latest version (currently 118.0.1902.202). The update includes a patch that removes the vulnerable code path.
• Configure automatic updates on all endpoints to ensure the patch is applied promptly.
• Implement a web‑filtering solution that blocks known malicious domains and prevents users from loading untrusted content.
• Educate users to avoid clicking on suspicious links or opening attachments from unknown senders.
• For environments that cannot immediately update, consider disabling JavaScript for internal sites or applying a group policy that blocks the affected feature set.

What to watch

Monitor the Microsoft Security Response Center (MSRC) for any follow‑up advisories that may indicate a new exploitation vector or a related vulnerability in the same code base.

Keep an eye on threat‑intel feeds for indicators of compromise that reference CVE‑2026‑118330 or anomalous network traffic patterns associated with Edge exploitation attempts.

Review incident‑response playbooks to incorporate detection of abnormal process memory access or crashes that could signal an attempt to exploit this use‑after‑free.