Microsoft Edge CVE-2026-57991

Exploitation requires the victim to interact with attacker-controlled content in Microsoft Edge (CVSS UI:R) - a user must open a malicious page, link, or file that triggers the improper link resolution; it is not a fully passive, no-click attack. No authentication is required against the target (PR:N, unauthenticated per the provided vector) and the attack is delivered over the network (AV:N) with low complexity (AC:L). The chief limiting factors are the mandatory user interaction and the fact that only confidentiality is impacted (I:N/A:N) - an attacker gains information disclosure, not code execution or system modification. The specific file or resource whose link is followed is not detailed in the description; confirm the exact triggering feature via the MSRC advisory.

The CVSS 3.1 base score is 7.4 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N: network reachable, low complexity, no privileges, but requiring user interaction, with high confidentiality impact and no integrity or availability impact. The user-interaction requirement (UI:R) is the primary limiting factor and pushes this below the automatable, drive-by tier - a victim must open or interact with malicious content. No EPSS score was provided in the input, so exploitation probability cannot be quantified here; the flaw is not in CISA KEV and no POC is referenced, so current signals point to a patch-worthy but not emergency issue. Note a mild tension worth verifying: link-following bugs are often local-filesystem oriented, yet the vector is AV:N with S:C - this implies the attack is delivered over the network (malicious web content) while the disclosed data crosses a scope boundary; confirm the exact data exposed via the vendor advisory. Overall this is a real, prioritizable browser confidentiality issue but not a widespread mass-exploitation threat on present evidence.

An attacker hosts a malicious web page or crafted file and lures a victim into opening it in Microsoft Edge; when Edge resolves an attacker-controlled link/path without validating the target, it reads and discloses sensitive information back to the attacker. Given AC:L and UI:R, the technical barrier is low but the attacker must convince the user to interact (visit a link, open content). No public exploit is identified at time of analysis.