A high-severity deserialization vulnerability in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to execute code over a network.

This is a deserialization of untrusted data flaw (CWE-502). An unauthenticated attacker can exploit this via the network to execute arbitrary code, though successful exploitation typically requires user interaction (UI:R).

The ability to execute arbitrary code remotely poses a significant risk to user workstations and organizational networks. With a CVSS score of 8.3, this vulnerability could lead to malware installation, unauthorized access to sensitive browser data, or further lateral movement within the network.

Immediate Action: Update all instances of Microsoft Edge to version 150.0.4078.48 or later as provided by Microsoft’s automated update mechanisms.

Proactive Monitoring: Monitor network traffic for suspicious deserialization patterns or unexpected browser behavior following user activity.

Compensating Controls: Ensure that browser-based security policies (such as disabling untrusted plugins) are enforced via Group Policy or Mobile Device Management (MDM).

Public Exploit Available: No

Given the ubiquity of the browser in corporate environments, this update should be treated as a high priority. Administrators should verify that all endpoints have successfully received the latest security update to mitigate the risk of remote code execution.