What is the CVSS score of CVE-2026-57977?

CVE-2026-57977 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Edge are affected by CVE-2026-57977?

Microsoft Edge is vulnerable to spoofing attacks that allow unauthenticated attackers to create convincing fake browser contexts, enabling credential theft or malware distribution.. A patch is available.

How to fix or mitigate CVE-2026-57977?

Within 24 hours: Document all Microsoft Edge deployments and versions across the organization. Within 7 days: Apply the Microsoft Edge patch released via MSRC to all affected systems and validate installation success. Within 30 days: Verify complete patch coverage across all endpoints and establish a process to prevent future unpatched instances.

Microsoft Edge CVE-2026-57977

EUVD-2026-41576 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-03 microsoft

GHSA-4w42-h73x-mj6m

XSS Google Microsoft Microsoft Edge Chromium Based

7.1

CVSS 3.1 · Vendor: microsoft

Temporal: 6.2

Severity by source

Vendor (microsoft) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

CIRCL (temporal)

6.2 MEDIUM

cvss

vuln.today AI

7.1 HIGH

Network-delivered XSS needing victim interaction (UI:R, PR:N, AC:L); spoofing yields high integrity impact and low confidentiality, no availability effect, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:24 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 7.1

DescriptionCVE.org

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

AnalysisAI

Spoofing in Microsoft Edge (Chromium-based) arises from a cross-site scripting (CWE-79) flaw that lets a network-based, unauthenticated attacker inject script into a generated web page, producing a convincing spoofed browser context after the victim interacts with malicious content. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:L/I:H) reflects a high-integrity spoofing impact gated only by user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Microsoft has released a patch through the MSRC update guide.

Technical ContextAI

The affected component is Microsoft Edge built on the Chromium engine (CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based)), so the root cause lies in how the browser renders or neutralizes untrusted input during web page generation. CWE-79 (improper neutralization of input during web page generation) means attacker-controlled data is reflected or stored into a page without adequate encoding, allowing script or markup to execute in the rendered context. Because the tags associate this with 'Google' and 'Microsoft Edge Chromium Based,' the flaw likely originates in shared Chromium rendering logic and is inherited/patched by Edge; the practical effect here is UI or content spoofing rather than full session compromise, consistent with the CVSS integrity-oriented, spoofing-focused impact.

RemediationAI

Patch available per vendor advisory: update Microsoft Edge to the fixed build published by Microsoft in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57977 (exact fixed version not specified in the provided data - verify the current stable/extended stable channel). Ensure Edge auto-update is enabled and restart the browser to apply the update, since Chromium fixes only take effect after relaunch. As interim compensating controls where immediate patching is not possible, restrict browsing to trusted sites via SmartScreen/enterprise policy and user awareness (the flaw requires the victim to interact with attacker content), noting these reduce but do not eliminate exposure; there is no server-side toggle to disable the affected rendering path without impacting normal browsing.