What is the CVSS score of CVE-2026-58286?

CVE-2026-58286 has a CVSS 3.1 base score of 6.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Edge are affected by CVE-2026-58286?

Microsoft Edge contains a high-severity spoofing vulnerability (CVSS 8.1) that allows remote, unauthenticated attackers to manipulate trusted UI elements and deceive users about content origins.. A patch is available.

How to fix or mitigate CVE-2026-58286?

Within 24 hours: Identify the scope of Microsoft Edge deployments across your environment using asset management tools. Within 7 days: Deploy the patch available per Microsoft's MSRC advisory (CVE-2026-58286) to all Edge instances through your patch management process. Within 30 days: Verify 100% patch coverage and enable automatic updates for ongoing protection.

Microsoft Edge CVE-2026-58286

EUVD-2026-41584 MEDIUM

Improper Access Control (CWE-284)

2026-07-03 microsoft

GHSA-6p36-3w3p-mr82

Authentication Bypass Microsoft Google Microsoft Edge Chromium Based

6.9

CVSS 3.1 · NVD

Temporal: 7.1

Severity by source

Vendor (microsoft) PRIMARY

HIGH

qualitative

NVD

6.9 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N

CIRCL (temporal)

7.1 HIGH

cvss

vuln.today AI

6.9 MEDIUM

Network spoofing is unauthenticated (PR:N) but realistically needs victim navigation (UI:R) and is timing-dependent (AC:H); scope changes across origins (S:C) with integrity spoofing high and no genuine availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Severity Changed

Jul 06, 2026 - 19:07 NVD

HIGH MEDIUM

CVSS changed

Jul 06, 2026 - 19:07 NVD

8.1 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Jul 03, 2026 - 21:47 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 8.1

DescriptionNVD

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

AnalysisAI

Spoofing in Microsoft Edge (Chromium-based) lets a remote, unauthenticated attacker misrepresent trusted UI or content to a victim by abusing improper access control (CWE-284), per Microsoft's own advisory (MSRC CVE-2026-58286). The high CVSS 8.1 is driven by a scope-changed impact (S:C) with high integrity effect, though the AC:H rating signals the attack is not trivially reliable. Currently there is no public exploit identified at time of analysis and no CISA KEV listing, so this is a proactively-patched issue rather than one under active exploitation.

Technical ContextAI

Microsoft Edge (Chromium-based) is Microsoft's browser built on the open-source Chromium/Blink engine, so its security model spans web origins, the same-origin policy, and the browser's own trusted UI (address bar, security indicators, permission prompts). The root cause is classified as CWE-284 Improper Access Control, meaning a resource, origin boundary, or UI surface is reachable or manipulable in a way it should not be. The scope-changed metric (S:C) indicates the flaw in one security authority (for example the renderer or a web origin) affects another (the browser chrome or a different origin), which is the classic pattern behind spoofing where attacker-controlled content is presented as belonging to a trusted context. The affected CPE is cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*, i.e. the application across unspecified versions pending Microsoft's version table.

RemediationAI

Apply the vendor patch: Microsoft has released a fix, and the primary action is to update Microsoft Edge (Chromium-based) to the patched build documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58286 - the exact fixed version is not included in the supplied data and should be taken from that page. Ensure Edge automatic updates are enabled so the browser pulls the corrected Chromium channel; in managed environments push the update via Microsoft Update, Intune, WSUS, or your endpoint management tooling and confirm the deployed build meets or exceeds the advisory's fixed version. As an interim compensating control while patching is pending, restrict exposure by discouraging navigation to untrusted sites, enabling Enhanced Security Mode / SmartScreen, and user-awareness of address-bar and dialog cues; note these controls reduce but do not eliminate a spoofing vector and impose usability friction, so they are stopgaps rather than substitutes for the update.