Microsoft Edge CVE-2026-57986

Exploitation requires the victim to actively interact with attacker-controlled web content - per the CVSS vector UI:R means user interaction (such as visiting a malicious page or clicking a crafted link) is mandatory, so this is not a zero-click attack. AC:H indicates additional non-trivial conditions, such as achieving a reliable heap layout/grooming, must be met for the use-after-free to be exploitable rather than merely crash the renderer. No authentication or privileges are needed (PR:N), and the scope is unchanged (S:U), meaning code runs within the browser's own sandboxed renderer process rather than automatically escalating to the host. Limiting factors that reduce realistic risk: required user interaction, high attack complexity, and dependence on the victim running an unpatched Edge build.

The CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - network reachable and requiring no privileges, but gated by high attack complexity and required user interaction, which meaningfully lowers real-world exploitability compared with a no-interaction drive-by bug. No EPSS score was supplied, so exploitation probability cannot be quantified from this data. The CVE is not in CISA KEV and no POC is indicated, so this should be treated as a standard high-priority browser patch rather than an emergency; however, browser UAF bugs are historically attractive to exploit developers, so the low apparent risk could change if exploit code emerges. The Denial-of-Service tag alongside the RCE classification is consistent with a memory-corruption bug that can either crash the renderer or, with more effort, achieve code execution.

An attacker hosts a malicious web page (or injects malicious content into a compromised or malvertised site) that triggers the use-after-free when rendered. A victim using an unpatched Microsoft Edge browser is lured into visiting the page, and the crafted content manipulates freed heap memory to execute attacker code in the browser process. The high attack complexity means reliable exploitation likely requires precise heap grooming, and no public POC is currently identified.