Windows WebView CVE-2026-56173

Exploitation requires the attacker to already possess local, low-privilege authenticated access to a Windows system running the vulnerable WebView component (per CVSS PR:L and AV:L). No user interaction is needed (UI:N). What limits exploitation is the high attack complexity (AC:H): the use-after-free is a race/lifecycle condition that the attacker must reliably trigger, so success is not guaranteed on the first attempt and may depend on timing, system load, or heap state. The attacker cannot reach this remotely and must first establish a local foothold, making it a second-stage escalation primitive rather than an initial-access vector.

The CVSS 3.1 base score is 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning local access and existing low privileges are required, exploitation involves meaningful complexity (AC:H, consistent with a use-after-free race window), but success grants full C/I/A impact within an unchanged scope. This is a privilege-escalation primitive, not a remote entry point - it is realistically chained after an attacker already has code execution as a standard user (e.g., post-phishing or via a low-priv service). No EPSS score was provided, the vulnerability is NOT in CISA KEV, and no POC was referenced, so there is no evidence of active or imminent widespread exploitation. The AC:H rating tempers urgency somewhat, but the ubiquity of Windows and the reliability with which UAF EoP bugs are weaponized over time make this a solid patch-cycle priority rather than an emergency. Note the Tags list 'Denial Of Service' while the vector asserts full C:H/I:H/A:H code-execution-level impact - the vector should be treated as authoritative; verify DoS-only claims against the MSRC advisory.

An attacker who has already obtained standard-user code execution on a Windows host (for example via a malicious document or a compromised low-privilege service) runs a crafted local program that manipulates WebView object lifecycles to win the use-after-free race and corrupt freed memory. Because exploitation requires local access, low privileges, and no user interaction, the attacker escalates from standard user to a high-privilege context, gaining full control of the machine. No public POC was identified at time of analysis, and the AC:H rating implies exploitation is non-trivial and may require multiple attempts to hit the race window.