Microsoft Edge CVE-2026-50521

Exploitation requires the attacker to hold some level of authorization (CVSS PR:L, and the description explicitly calls the actor an 'authorized attacker'), meaning it is not a fully unauthenticated internet-wide attack; the exact privilege - such as a logged-in browser session, a compromised low-privilege renderer, or authenticated access to attacker-served content - is not specified in the provided data and should be confirmed via the MSRC advisory. The vector lists UI:N, but as a browser use-after-free the realistic trigger is the victim's Edge instance processing attacker-controlled web content, which is a practical limiting factor. Additional limits: only Chromium-based Microsoft Edge is affected, the exploit maturity is Unproven (E:U) with no public exploit, and an official patch (RL:O) is already available, so updated installations are not exposed.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L yields 8.3 (High), driven by network reachability, low complexity, and high confidentiality/integrity impact, offset by a requirement for some privilege (PR:L) and only partial availability impact (A:L). Crucially, the temporal metrics E:U/RL:O/RC:C indicate Unproven exploit maturity, an Official fix, and a Confirmed report - so despite the high base score, there is no public exploit identified and it is not in CISA KEV, lowering near-term real-world exploitation risk. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Note a data tension worth verifying: the vector specifies UI:N (no user interaction) yet browser use-after-free bugs realistically require the victim to render attacker-controlled web content, and the description labels the actor an 'authorized attacker' (PR:L) without clarifying what privilege is required - confirm the exploitation preconditions against the MSRC advisory before prioritization.

An attacker lures or directs a targeted Edge user to attacker-controlled web content (or leverages an already-authorized foothold implied by PR:L) that triggers the use-after-free, corrupting heap memory to hijack a freed object and execute code in the browser process. Given AC:L, the trigger is reliable once the vulnerable code path is reached, but the temporal metric E:U indicates no public exploit code exists at time of analysis, so exploitation would require original vulnerability-research effort.