Microsoft Edge CVE-2026-58286

Exploitation targets Microsoft Edge (Chromium-based) over the network with no authentication (PR:N) and, per the CVSS vector, no user interaction flagged (UI:N); the primary limiting factor is high attack complexity (AC:H), meaning the attacker must satisfy conditions outside their control - likely a race, precise navigation timing, or a specific rendering state - for the spoof to land. The description does not name a specific feature toggle or non-default configuration, so the constraint is the AC:H reliability barrier rather than a config prerequisite. Caution: the combination of a spoofing/authentication-bypass impact with UI:N is atypical, since spoofing usually requires the victim to view attacker content - verify against Microsoft's advisory whether victim navigation is in practice required before assuming zero interaction.

The signals are mixed and should be read carefully. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L) yields 8.1 'High' largely because of the scope change and high integrity impact combined with no privileges and no user interaction; however AC:H tells us successful exploitation depends on conditions the attacker does not fully control (timing, race, or victim navigation), which materially lowers real-world reliability. There is no CISA KEV entry and no evidence of public POC, so both exploitation-probability signals point low despite the high base score. No EPSS score or SSVC decision data was provided, so automatable/technical-impact cannot be independently derived - treat the 8.1 as a worst-case ceiling. Notably, UI:N is unusual for a spoofing/authentication-bypass class bug that normally requires a victim to visit a page; this apparent tension between UI:N and a spoofing impact should be verified against Microsoft's advisory before treating it as a no-interaction remote threat. Overall this is a patch-on-cycle priority for browser fleets, not an emergency, absent exploitation evidence.

An attacker hosts or injects crafted web content that abuses the improper access-control flaw to render trusted-looking UI or content that appears to originate from a legitimate origin, then lures or races a victim's Edge browser into displaying it. Because the scope changes across a security boundary, the spoofed content can misrepresent a different origin or the browser chrome, enabling convincing phishing or trust manipulation. No public exploit code has been identified, and the AC:H rating means the attacker must win specific timing or configuration conditions for the spoof to succeed.