CVE-2025-49713
Published: 02 July 2025
Summary
CVE-2025-49713 is a high-severity Type Confusion (CWE-843) vulnerability in Microsoft Edge Chromium. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 13.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-49713 is a type confusion vulnerability, tracked under CWE-843, that affects Microsoft Edge when built on the Chromium engine. The flaw permits an unauthorized attacker to execute arbitrary code over a network connection and carries a CVSS 3.1 base score of 8.8.
An attacker can trigger the issue remotely with no privileges required and only user interaction in the form of visiting a malicious web page. Successful exploitation grants full read, write, and execute capabilities on the affected system, resulting in complete loss of confidentiality, integrity, and availability.
The Microsoft Security Response Center advisory published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49713 contains the official guidance on available patches and mitigation steps. The associated EPSS score has remained low, moving only from a peak of 0.0324 to a current value of 0.0296.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-19745
Vulnerability details
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.