Microsoft Edge CVE-2026-56646

User interaction is required - the victim must actively navigate to or interact with attacker-controlled web content in Microsoft Edge (UI:R in CVSS vector). No authentication or local access is required from the attacker's side (PR:N, AV:N). The vulnerability appears to affect default Edge configurations across all versions below 150.0.4078.48 with no special feature flag or non-default setting named in the available data. Exploitation is limited by the social engineering step needed to direct a user to the attacker's page; without user interaction, remote exploitation is not possible per the CVSS vector. The scope is unchanged (S:U), meaning the impact is confined to the Edge browser process and its accessible data - no broader OS compromise is indicated by available data.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N yields a score of 6.5, reflecting a moderate-to-notable risk profile. The network attack vector with low complexity and no privilege requirement means any attacker who can lure a user to a malicious page can trigger the vulnerability - a realistic threat model for a browser. The sole friction is UI:R, requiring the victim to take an action (e.g., click a link or visit a page), which limits drive-by exploitation but remains highly achievable via phishing. The C:H rating signals that the disclosed information is meaningful - not a minor metadata leak. No EPSS score was provided in the input, so exploitation probability cannot be quantified statistically. No KEV listing and no confirmed public exploit code are known at time of analysis, suggesting this has not yet been weaponized at scale. The combination of widespread Edge deployment in enterprise Windows environments and a low-friction social-engineering pathway makes this a genuine patching priority, despite the absence of confirmed active exploitation.

An attacker sends a targeted phishing email or social-media message containing a link to an attacker-controlled webpage. When the victim opens the link in an unpatched Microsoft Edge browser, the page triggers the CWE-200 information disclosure, leaking sensitive browser data (such as origin context or session identifiers) to the attacker's server. The attacker uses the leaked data to construct a convincing spoofed page or identity, potentially enabling credential theft or session hijacking. No confirmed public exploit code exists at time of analysis.