CVE-2025-21279: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Overview

Severity
Medium (CVSS 6.5)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RC:C
Category
Edge - Chromium
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2025-Feb
Released
2025-02-06
EPSS Score
0.91% (percentile: 75.8%)

FAQ

According to the CVSS metric, the attack vector is network (AV:N) and user interaction is required (UI:R). What is the target context of the remote code execution? Successful exploitation of this vulnerability requires the victim user to click a malicious link so that the attacker can initiate remote code execution on the renderer process. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? The user would have to click on a specially crafted URL to be compromised by the attacker. What is the version information for this release? Microsoft Edge Version Date Released Based on Chromium Version 133.0.3065.51 2/6/2025 133.0.6943.53/54

Affected Products (1)

Browser

  • Microsoft Edge (Chromium-based)

Acknowledgments

<a href="https://x.com/eternalsakura13">Nan Wang(@eternalsakura13)</a>

Revision History

  • 2025-02-06: Information published.