Microsoft Edge CVE-2026-58276

Exploitation requires the victim to actively open or interact with attacker-controlled web content in Microsoft Edge (CVSS UI:R), so it cannot be triggered silently server-side; no authentication is needed (PR:N), meaning any user who is socially engineered to a malicious page is at risk. The key limiting factors are high attack complexity (AC:H) - the attacker must win a memory-reuse race or achieve precise heap layout to reliably hit the freed object - and the requirement that the target run an unpatched Chromium-based Edge build; patched builds and the absence of any special server configuration mean default installations are only exploitable through user-initiated navigation.

The signals are moderate and internally consistent rather than alarming. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5) shows a network-reachable, unauthenticated flaw with high confidentiality/integrity/availability impact, but two brakes limit real-world risk: high attack complexity (AC:H) implies non-trivial heap grooming or a race condition, and required user interaction (UI:R) means the victim must open malicious content. There is no EPSS score provided, no SSVC decision data, no KEV listing, and no evidence of public POC - so this is a real-but-not-emergency patch-priority issue, not a mass-exploited zero-day. No conflicting data was observed; the main missing signals are EPSS probability and independent exploitation evidence, which prevents ranking it above other patched browser UAF bugs.

An attacker hosts a malicious web page containing crafted JavaScript/DOM content that grooms the heap and triggers the dangling pointer, then lures a victim to visit it via phishing, malvertising, or a compromised site. When the victim's Edge browser renders the page, the use-after-free is triggered and attacker-supplied data is executed as code within the browser process. No public POC has been identified, and the high attack complexity means the exploit is not trivially reliable.