CVE-2024-43566: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

PriorityP262critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.08%

61.3th percentile

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Affected

3 ranges

Vendor	Product	Version range	Fixed in
microsoft	edge_chromium	< 130.0.2849.46	130.0.2849.46
microsoft	microsoft_edge	>= 1.0.0 < 130.0.2849.46	130.0.2849.46
msrc	microsoft_edge	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Exploitation requires the victim to click a specially crafted/malicious URL, triggering RCE in the Edge renderer process — monitor for suspicious Edge renderer process spawning child processes or unusual network activity following URL navigation. ↗
→Attack vector is network with required user interaction via a crafted URL — inspect web proxies and email gateways for links targeting Edge-specific URL schemes or triggering Edge navigation. ↗

·As of the advisory publication, the vulnerability has not been publicly disclosed or exploited in the wild, reducing immediate urgency but not eliminating risk. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vendor_msrc7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.