CVE-2026-62765
Microsoft — Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft · CWE-843
Patch Tuesday
12
EVRS 12 of 100 Elevated
Scheduled Maintenance
Rank 2,123 of 2,977 tracked
Why it scores 12
Evidence available: 5 of 8 signalsCVSS base score 7.5.
- CISA KEVDid not apply
- RansomwareNo data
- Vendor exploitationDid not apply
- EPSSNo data
- Microsoft Exploitability IndexDid not apply
- Pre-patch disclosureDid not apply
- KEV recencyNo data
- CVSSApplied
The band answers “how soon”, not “how bad”. No data for: Ransomware, EPSS, KEV recency. Why some signals show no data
Fix
No fixed version identified yetAffected versions
Not identified by the connected sources
Remediation
NVD lists one or more references for this CVE that aren't tagged as a patch or vendor advisory. Review them directly to confirm patch availability and applicability before making a remediation decision.
Evidence
Each value with its source| Measure | Value | Source |
|---|---|---|
| CVSS base scoreHow severe the flaw is in itself. It does not say how likely an attack is. | 7.5 | NVD |
| FIRST EPSSFIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs. | Not published | FIRST EPSS |
| Actively exploitedWhether a source of record has confirmed attacks using it in the wild. | Not confirmed | Patch Tuesday |
| Public exploit moduleA module existing is not the same as active exploitation. | None known | Metasploit |
| EUVD cross-referenceENISA's record: CVSS 7.5 (v3.1), assigned by microsoft. | Listed | ENISA EUVD |
Description
NVDAccess of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.