What is the CVSS score of CVE-2026-58278?

CVE-2026-58278 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-58278?

Yes, a patch is available for CVE-2026-58278. Update the affected software to the latest version immediately.

Microsoft Edge CVE-2026-58278

EUVD-2026-41581 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-03 microsoft

GHSA-89m8-6fh5-pgm5

SSRF Microsoft Google Microsoft Edge Chromium Based

5.4

CVSS 3.1 · NVD

Temporal: 4.7

Severity by source

Vendor (microsoft) PRIMARY

MEDIUM

qualitative

NVD

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CIRCL (temporal)

4.7 MEDIUM

cvss

vuln.today AI

5.4 MEDIUM

Network-delivered SSRF requires no attacker privileges, but mandatory user interaction and no scope change or confidentiality loss keep score moderate.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 22:06 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

MEDIUM 5.4

DescriptionNVD

Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

AnalysisAI

Server-side request forgery in Microsoft Edge (Chromium-based) versions before 150.0.4078.48 enables unauthenticated remote attackers to perform network spoofing by inducing the browser to issue forged requests on behalf of a victim. The attack requires user interaction - a victim must visit or interact with attacker-controlled content - after which the browser can be coerced into making unauthorized requests that manipulate resource integrity or availability. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; a vendor-released patch is available.

Technical ContextAI

CWE-918 (Server-Side Request Forgery) describes a class of vulnerabilities where an application - in this case the browser itself - is manipulated into making HTTP or other protocol requests to attacker-chosen destinations, bypassing normal access controls or trust boundaries. In a Chromium-based browser context, SSRF can arise in features such as content prefetching, service workers, media loading, or URL handlers that issue outbound network requests on behalf of rendered page content. The affected CPE (cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*) spans all Edge Chromium releases from version 1.0.0.0 up to but not including 150.0.4078.48 per EUVD-2026-41581. Because Edge is built on the Chromium engine, underlying Chromium networking code - including Fetch API, XMLHttpRequest, or network service components - may be the root-cause site.

RemediationAI

The primary fix is to upgrade Microsoft Edge (Chromium-based) to version 150.0.4078.48 or later, as confirmed by the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58278 and corroborated by EUVD-2026-41581. Edge typically auto-updates via its built-in update mechanism; administrators managing enterprise deployments should verify the installed version and push the update via Microsoft Endpoint Manager or equivalent. Where immediate patching is not feasible, reducing exposure requires limiting user access to untrusted web content (e.g., restricting browsing to allowlisted sites via enterprise policy), though this has significant usability trade-offs. Disabling specific Edge features such as prefetch or service workers via Group Policy may reduce SSRF attack surface but does not eliminate it and may affect legitimate functionality. No workaround fully substitutes for the vendor-released patch.