Microsoft Edge CVE-2026-58285

Exploitation requires the victim to actively load attacker-controlled web content in Microsoft Edge (Chromium-based) - the CVSS UI:R metric confirms user interaction is mandatory, so this is not a zero-click bug. No authentication against the target is needed (PR:N), and the attack is delivered over the network by getting the user to visit a malicious or compromised page. Limiting factors: the high attack complexity (AC:H) implies the exploit depends on winning a race or achieving a specific memory/heap state rather than firing deterministically, and only the Chromium-based Edge desktop browser is affected. The description states no special server-side or non-default configuration prerequisite beyond rendering hostile web content.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, score 8.3) describes a network-reachable, unauthenticated bug with full confidentiality/integrity/availability impact and a scope change consistent with a sandbox or process boundary crossing, but two mitigating metrics - AC:H (high complexity, e.g. heap grooming or a race) and UI:R (the victim must visit or interact with attacker content) - meaningfully lower real-world exploitability versus a drive-by zero-click bug. It is NOT in CISA KEV and no POC is referenced, so there is no evidence of active exploitation; EPSS was not supplied in the input and cannot be cited. The signals are internally consistent (network browser RCE requiring a user to open malicious content), so this is a genuine but patch-and-move-on priority rather than an emergency: high severity by impact, tempered by required user interaction and high complexity. Note the 'Authentication Bypass' tag is not supported by any other data field and appears to be a generic label; do not treat it as a confirmed auth-bypass capability.

An attacker hosts a malicious web page containing crafted JavaScript that triggers the type-confusion condition in Edge's rendering/JS engine, then emails or otherwise lures a target into opening it. When the victim visits the page and the exploit succeeds, memory corruption is leveraged to execute attacker code in the browser context; the high attack complexity means a reliable exploit likely requires precise heap manipulation, and no public POC is currently known.