Microsoft Edge CVE-2026-58283

Exploitation requires the victim's Edge browser to load and process attacker-controlled web content (a malicious or compromised page / injected resource) that triggers the type-confusion path in the Chromium engine. Limiting factors: the CVSS carries high attack complexity (AC:H), meaning the attacker must win specific engine-state/timing conditions to trigger the confusion reliably; the impact is characterized as spoofing (integrity) rather than code execution; and no working exploit is known (E:U). Ambiguity to verify: the vector states UI:N (no user interaction), but a browser-rendered spoofing flaw typically depends on the user navigating to attacker content - confirm the true interaction requirement with Microsoft, as it directly limits realistic exploitability.

The signals are mixed and lean toward moderate real-world priority. On the elevating side: AV:N (network-reachable), PR:N (no privileges), UI:N (no user interaction claimed), S:C (scope change), and I:H combine to a CVSS 8.1. On the tempering side: AC:H marks exploitation as genuinely difficult, and the temporal metrics are reassuring - E:U (no proven exploit), RL:O (official remediation available), RC:C (confirmed). No EPSS score was provided, and the CVE is not in CISA KEV, so there is no evidence of active or widespread exploitation. Note a data tension worth flagging: the CVSS declares UI:N (no user interaction), yet a browser spoofing/type-confusion issue realistically requires the victim to visit or render attacker-controlled content - verify the interaction requirement with Microsoft, as it materially changes exploitability. Also note the description says 'spoofing' while the tags say 'Authentication Bypass' and 'Memory Corruption'; treat the precise impact as vendor-characterized rather than independently confirmed.

An attacker hosts a malicious web page containing crafted script that triggers the type-confusion condition in Edge's Chromium engine; when a victim's browser processes it, the flaw is abused to spoof trusted content or origin (for example, faking a security indicator or page identity) and mislead the user. Given AC:H, reliable exploitation requires precise engine-state grooming, and no public proof-of-concept has been identified at time of analysis.