Microsoft Edge CVE-2026-57992

Exploitation requires a victim using Microsoft Edge (Chromium-based) to actively load attacker-controlled web content (UI:R) - for example clicking a link or visiting a malicious/compromised page - no authentication or prior privileges are needed (PR:N). Exploitation is materially limited by high attack complexity (AC:H), reflecting the heap-grooming and memory-layout conditions needed to reliably reclaim the freed object, and by the requirement for user interaction; scope is unchanged (S:U), so code executes within the browser renderer context and a separate sandbox-escape would be required to reach the underlying host. No non-default configuration is stated as necessary, so default Edge installs are affected.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a network-reachable, unauthenticated flaw with high impact to confidentiality, integrity, and availability, but two factors materially lower real-world risk: high attack complexity (AC:H) reflects the non-deterministic heap grooming needed to weaponize a UAF, and required user interaction (UI:R) means the victim must actively load malicious content. The temporal metrics reinforce a lower urgency: E:U (exploit code unproven), RL:O (official fix available), and RC:C (confirmed) - consistent with the absence of KEV and POC signals, giving no public exploit identified at time of analysis. No EPSS score was provided and there is no SSVC decision data, so automatability and observed-exploitation status cannot be quantified. Net assessment: a genuinely high-impact, patchable browser RCE that is not an emergency in the absence of exploitation evidence - prioritize via normal rapid browser-patching cadence rather than out-of-band response, while noting the scope is unchanged (S:U), so a separate sandbox-escape would be needed for full host takeover.

An attacker hosts a malicious web page (or malvertising/compromised site) containing content crafted to trigger the use-after-free in Edge's rendering engine, then lures a victim into visiting it via a phishing link or malicious ad. When the page loads, the freed object is reclaimed with attacker-controlled data, yielding code execution in the renderer; high attack complexity means reliable exploitation requires careful heap grooming, and no public POC is currently known.