What is the CVSS score of CVE-2026-57991?

CVE-2026-57991 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.8%.

Which versions of Microsoft Edge are affected by CVE-2026-57991?

Microsoft Edge users face data exposure risk when visiting malicious websites, with exploitation requiring only user interaction and no special account privileges.. A patch is available.

How to fix or mitigate CVE-2026-57991?

Within 24 hours: Notify IT and End User teams; identify all Edge deployments and current version baselines. Within 7 days: Deploy Microsoft Edge security update via your patch management system; prioritize machines accessing sensitive data repositories or containing cached credentials. Within 30 days: Audit deployment compliance; confirm zero unpatched instances remain; review browser security policy (e.g., disable access to untrusted domains where operationally feasible).

Microsoft Edge CVE-2026-57991

EUVD-2026-41579 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-07-03 microsoft

GHSA-c7hg-fxjp-q9jp

Information Disclosure Microsoft Google Microsoft Edge Chromium Based

7.4

CVSS 3.1 · Vendor: microsoft

Temporal: 6.4

Severity by source

Vendor (microsoft) PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

CIRCL (temporal)

6.4 MEDIUM

cvss

vuln.today AI

7.4 HIGH

Network-delivered malicious content with low complexity and no auth, but requires user interaction; only confidentiality is impacted and disclosed data crosses the browser scope boundary (S:C).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:29 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 7.4

DescriptionCVE.org

Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

AnalysisAI

Information disclosure in Microsoft Edge (Chromium-based) lets a remote attacker read sensitive data by abusing improper symbolic/link resolution (CWE-59) when a victim interacts with attacker-controlled content. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and the scope-changed impact (S:C) indicates data is exposed beyond the browser's own security boundary. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host malicious web content or file

Delivery

Lure victim to open in Edge

Exploit

Trigger improper link/symlink resolution

Execution

Browser follows link to protected data

Impact

Disclose sensitive information to attacker

Access

Host malicious web content or file

Delivery

Lure victim to open in Edge

Exploit

Trigger improper link/symlink resolution

Execution

Browser follows link to protected data

Impact

Disclose sensitive information to attacker

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to interact with attacker-controlled content in Microsoft Edge (CVSS UI:R) - a user must open a malicious page, link, or file that triggers the improper link resolution; it is not a fully passive, no-click attack. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score is 7.4 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N: network reachable, low complexity, no privileges, but requiring user interaction, with high confidentiality impact and no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page or crafted file and lures a victim into opening it in Microsoft Edge; when Edge resolves an attacker-controlled link/path without validating the target, it reads and discloses sensitive information back to the attacker. Given AC:L and UI:R, the technical barrier is low but the attacker must convince the user to interact (visit a link, open content). …
Remediation	Patch available per vendor advisory: update Microsoft Edge (Chromium-based) to the fixed build documented by Microsoft at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57991 - the input does not include an exact fixed version number, so pull the precise build from that advisory rather than an assumed value. … Detailed patch versions, workarounds, and compensating controls in full report.