Microsoft Edge CVE-2026-42838

Exploitation requires that a target actively interact with attacker-controlled content in an unpatched Microsoft Edge browser (UI:R per CVSS vector) - for example, navigating to a malicious web page or loading injected content from an untrusted source. The attack is network-delivered (AV:N) and requires no prior authentication or privileges on the part of the attacker (PR:N). Limiting factors include: mandatory user interaction, meaning passive network exposure alone is insufficient; unchanged scope (S:U), meaning impact is confined to the browser process and does not escape to the underlying OS or other applications; and partial-only impact confined to confidentiality and integrity (A:N). No special non-default configuration is required for exploitation - any user browsing with an affected Edge version is potentially at risk if they interact with malicious content.

The CVSS 3.1 score of 5.4 (Medium) reflects network reachability, low attack complexity, and no required privileges, but is tempered by mandatory user interaction (UI:R) and unchanged scope (S:U) with only partial impact (C:L/I:L/A:N). Critically, the real-world risk signals align in reducing urgency: EPSS at 0.04% places this in the 13th percentile, SSVC assesses exploitation as none and automatable as no, and no KEV listing exists. CVSS and SSVC are consistent here - the partial technical impact and non-automatable nature mean mass exploitation is not a realistic near-term threat. There is no data conflict between the network attack vector and the description, which is consistent with browser-delivered injection. This is a genuine but low-priority finding unless specific threat actors are targeting your Edge user base with spear-phishing-style content delivery.

An attacker hosts a malicious web page containing specially crafted injection payloads targeting a downstream Edge browser component. A target user is socially engineered into visiting the page - via phishing email, redirect, or embedded link - and upon loading the content in an unpatched Edge instance, the injection is processed by a privileged internal component, granting the attacker partial access to confidentiality and integrity controls within the browser process. No public exploit code has been identified at time of analysis, and the attack is not assessed as automatable by SSVC.