Microsoft Edge 150.0.4078.48 - RCE

ExploitDBExploitDB exploitScannerEDB-52632

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python HTTP server that serves a static HTML page containing JavaScript. The JavaScript attempts to trigger a type confusion vulnerability in the V8 engine by repeatedly calling a function with an object and then assigning a value to a property, but it does not contain any shellcode, memory corruption primitives, or code execution payload. The author's notes explicitly state it is a 'Proof of Concept only' and 'No public full exploit is available yet.' The code's primary operation is to serve a test page that checks for a crash or observable behavior, consistent with a vulnerability scanner or trigger, not a working exploit.

Backdoor review

No backdoor observed in reviewed code

The PoC is a simple Python HTTP server that delivers a static HTML page containing JavaScript intended to trigger a type confusion vulnerability in Microsoft Edge. The code performs no file system writes, network connections beyond the local HTTP server, persistence mechanisms, or delivery of unrelated payloads. No obfuscation or concealed behavior is present.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPythonJavaScriptHTML
Target softwareMicrosoft Edge (Chromium-based)
Attack typesType Confusion
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is classified as a scanner because its primary operation is to serve a test page that attempts to trigger a type confusion condition and instructs the user to monitor for crashes, without containing any exploit payload, memory manipulation, or code execution logic. The author explicitly states it is a 'Proof of Concept only' and that 'No public full exploit is available yet.'

exploits/multiple/local/52632.py`:29exploits/multiple/local/52632.py`:42exploits/multiple/local/52632.py`:70-78

Requirements

  • Victim must visit the attacker-controlled HTTP server with a vulnerable version of Microsoft Edge (before 150.0.4078.48).exploits/multiple/local/52632.py`:11exploits/multiple/local/52632.py`:39

Observed behavior

  • Starts an HTTP server on port 8080 (or a custom port) and serves a static HTML page at '/' or '/poc.html'.exploits/multiple/local/52632.py`:95-101exploits/multiple/local/52632.py`:106-118
  • The served HTML page contains JavaScript that creates an object, calls a dummy function on it 10,000 times, then assigns the value 0x41414141 to a property of the object, logging a message to the console.exploits/multiple/local/52632.py`:70-78
  • The author's notes instruct the user to monitor the browser process for crashes or code execution, indicating the code is intended to test for a vulnerability rather than reliably achieve code execution.exploits/multiple/local/52632.py`:29exploits/multiple/local/52632.py`:42
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Service
TCP server on port 8080 (configurable via --port argument)The PoC starts a local HTTP server to deliver the exploit page to a vulnerable browser.exploits/multiple/local/52632.py`:106-118
Javascript Payload
Type confusion trigger using object property assignment and array allocationThe JavaScript attempts to trigger CVE-2026-58289 by manipulating object types in a loop and assigning a value to a property.exploits/multiple/local/52632.py`:70-78
Review boundaries

What the analysis did not establish

  • The analysis is based solely on the static source code; the code was not executed, and its actual behavior in a vulnerable environment is not verified.
  • The JavaScript payload is simplistic and lacks any demonstrated memory corruption or code execution capability, consistent with a trigger or scanner rather than a functional exploit.
  • Only the supplied text file was reviewed; no external resources, libraries, or binary files were inspected.
  • The JavaScript payload is a simplified trigger and may not reliably exploit the vulnerability; its effectiveness is not assessed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1