What is the CVSS score of CVE-2026-57991?

CVE-2026-57991 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.8%.

Which versions of Microsoft Edge are affected by CVE-2026-57991?

Microsoft Edge users face data exposure risk when visiting malicious websites, with exploitation requiring only user interaction and no special account privileges.. A patch is available.

How to fix or mitigate CVE-2026-57991?

Within 24 hours: Notify IT and End User teams; identify all Edge deployments and current version baselines. Within 7 days: Deploy Microsoft Edge security update via your patch management system; prioritize machines accessing sensitive data repositories or containing cached credentials. Within 30 days: Audit deployment compliance; confirm zero unpatched instances remain; review browser security policy (e.g., disable access to untrusted domains where operationally feasible).

Microsoft Edge CVE-2026-57991

EUVD-2026-41579 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-07-03 microsoft

GHSA-c7hg-fxjp-q9jp

Information Disclosure Microsoft Google Microsoft Edge Chromium Based

7.4

CVSS 3.1 · Vendor: microsoft

Temporal: 6.4

Severity by source

Vendor (microsoft) PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

CIRCL (temporal)

6.4 MEDIUM

cvss

vuln.today AI

7.4 HIGH

Network-delivered malicious content with low complexity and no auth, but requires user interaction; only confidentiality is impacted and disclosed data crosses the browser scope boundary (S:C).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:29 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 7.4

DescriptionCVE.org

Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

AnalysisAI

Information disclosure in Microsoft Edge (Chromium-based) lets a remote attacker read sensitive data by abusing improper symbolic/link resolution (CWE-59) when a victim interacts with attacker-controlled content. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and the scope-changed impact (S:C) indicates data is exposed beyond the browser's own security boundary. Microsoft has released a fix; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

The vulnerability is a link-following (link resolution) weakness classified as CWE-59, in which the software accesses a file or resource through a name (such as a symbolic link, junction, or hard link) without first verifying that the target is the intended object. In a Chromium-based browser like Microsoft Edge, such flaws typically arise when the browser or one of its file-handling components resolves a path - for example during downloads, cache/profile file operations, or handling of local resources - and follows an attacker-planted link to a location the browser should not read. The single affected CPE is cpe:2.3:a:microsoft:microsoft_edge_(chromium-based), i.e., the Chromium-based Edge desktop browser rather than the legacy EdgeHTML engine. The CVSS scope change (S:C) reflects that the disclosed information crosses the trust boundary of the vulnerable component, consistent with reading data outside the browser sandbox or user context.

RemediationAI

Patch available per vendor advisory: update Microsoft Edge (Chromium-based) to the fixed build documented by Microsoft at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57991 - the input does not include an exact fixed version number, so pull the precise build from that advisory rather than an assumed value. Because Edge auto-updates, ensure the browser is allowed to complete its update cycle and relaunch, and in managed environments push the update via your standard channel (WSUS/Intune/Edge update policies) and verify the version through edge://settings/help. As a temporary compensating control until deployment, advise users to avoid opening untrusted links and downloads that could trigger the link-resolution path, and enforce SmartScreen and download restrictions to reduce exposure to attacker-controlled content; these controls reduce but do not eliminate risk, and they add user friction, so they are not a substitute for the update.