What is the CVSS score of CVE-2026-57987?

CVE-2026-57987 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Is there a patch available for CVE-2026-57987?

Yes, a patch is available for CVE-2026-57987. Update the affected software to the latest version immediately.

Microsoft Edge CVE-2026-57987

EUVD-2026-41651 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-03 microsoft

GHSA-pgfj-jh8g-79g5

Google SSRF Microsoft Microsoft Edge Chromium Based

6.5

CVSS 3.1 · Vendor: microsoft

Temporal: 5.7

Severity by source

Vendor (microsoft) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CIRCL (temporal)

5.7 MEDIUM

cvss

vuln.today AI

6.5 MEDIUM

Network SSRF triggered by user visiting a page (AV:N, UI:R, PR:N); high confidentiality from internal resource exposure; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 22:03 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

MEDIUM 6.5

DescriptionCVE.org

Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

AnalysisAI

Server-side request forgery in Microsoft Edge (Chromium-based) prior to version 150.0.4078.48 allows unauthenticated network attackers to perform spoofing by inducing a victim user to visit a malicious page, causing the browser to issue forged requests to internal or external resources. The confidentiality impact is rated High (CVSS C:H), indicating that sensitive data accessible via the browser's network context may be exfiltrated through the SSRF channel. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

CWE-918 (Server-Side Request Forgery) describes a class of vulnerabilities where an application can be manipulated into issuing requests to unintended destinations on behalf of an attacker. In a Chromium-based browser context, SSRF may arise from mishandled redirects, prefetch APIs, fetch directives, service worker request interception, or resource-loading logic that fails to enforce same-origin or destination restrictions. The affected product is the Chromium-based variant of Microsoft Edge (CPE: cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*), covering all versions from 1.0.0.0 up to but not including 150.0.4078.48. The Chromium network stack's request routing layer is the likely locus of the flaw, and the 'spoofing' characterization from Microsoft suggests the forged request can be used to impersonate the victim browser to downstream services.

RemediationAI

The primary fix is to upgrade Microsoft Edge (Chromium-based) to version 150.0.4078.48 or later, which contains the vendor-released patch per the Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57987. Edge typically auto-updates in consumer and enterprise environments; administrators should verify managed deployments have received this update via Microsoft Endpoint Manager or Group Policy. Where immediate patching is not feasible, enforcing strict network egress filtering on managed endpoints to block browser-initiated requests to internal RFC-1918 address spaces limits the SSRF reach - note this may interfere with legitimate intranet browsing. User education to avoid clicking unsolicited links provides a behavioral compensating control given the mandatory UI:R prerequisite, though it is not a technical substitute for patching.