EUVD-2026-41567
GHSA-hq62-8562-72xh
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Remote, unauthenticated, low-complexity SSRF requiring user interaction (UI:R); crosses the browser trust boundary (S:C) with confidentiality-only impact (C:H, I:N, A:N).
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Server-side request forgery in Microsoft Edge (Chromium-based) lets a remote, unauthenticated attacker coax a victim's browser into issuing forged network requests, enabling spoofing and disclosure of sensitive data over the network. Exploitation requires user interaction (visiting or interacting with attacker-controlled content), and the CVSS scope-change flag indicates the browser can be pivoted to reach resources beyond its own security boundary. No public exploit identified at time of analysis (CVSS E:U), but a vendor fix is already available and the finding is vendor-confirmed (RC:C).
Technical ContextAI
The affected component is the Chromium-based Microsoft Edge browser (cpe:2.3:a:microsoft:microsoft_edge_(chromium-based)). The root cause class is CWE-918 (Server-Side Request Forgery): the browser can be induced to make requests to a destination chosen or influenced by an attacker, without adequately validating or restricting the target. In a browser context, SSRF-style flaws typically stem from the rendering/networking layer following attacker-controlled URLs, redirects, or resource references, allowing requests to be directed at internal or otherwise unintended endpoints. The CVSS scope-change (S:C) reflects that the impact crosses the browser's own trust boundary - the compromised component (Edge) is used to reach a different security authority (e.g., internal network resources).
RemediationAI
Patch available per vendor advisory: update Microsoft Edge to the fixed build documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57993 (RL:O confirms an official remediation exists); the input does not specify an exact fixed version number, so confirm the target build from the MSRC page before deployment. Because Edge auto-updates by default, ensure the browser's automatic update mechanism is enabled and not blocked by group policy, and force-restart Edge on managed endpoints to apply the update. As a compensating control until patched, restrict browsing of untrusted sites and enforce network egress/segmentation so that browser-originated requests cannot reach sensitive internal endpoints (SSRF targets) - with the trade-off that aggressive egress filtering can break legitimate internal web applications and should be scoped to sensitive segments.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execu
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today