Microsoft Edge CVE-2026-58289

Exploitation requires the victim to actively load attacker-controlled web content in a vulnerable Edge build (before 150.0.4078.48) - the UI:R metric confirms mandatory user interaction (visiting a malicious or compromised page), and no authentication is required (PR:N). Limiting factors: the AC:H rating indicates the attacker needs a specially crafted page and a reliable trigger for the type-confusion condition (not trivially repeatable), and success depends on defeating browser sandbox/mitigations to convert memory corruption into code execution. There is no requirement for special product configuration named in the description, but exploitation is bounded by the need to reach the user (social engineering / malicious link) and by the specific vulnerable version range.

Signals are mixed and point to a serious-but-not-emergency priority. CVSS 8.3 (HIGH) with AV:N/PR:N and total technical impact (C:H/I:H/A:H) reflects severe potential consequences, but AC:H and UI:R meaningfully constrain real-world exploitation - an attacker needs a reliable exploit AND must convince a user to visit attacker-controlled content. This aligns with CISA SSVC (Exploitation: none, Automatable: no, Technical Impact: total) and a low EPSS of 0.53% (41st percentile), indicating no observed exploitation and low near-term probability. There is no KEV listing and no POC referenced in the provided data. The 'Authentication Bypass' tag is not clearly supported by the type-confusion/RCE description or the CVSS vector and may be a mis-tag - treat it with caution and verify against the MSRC advisory. Net: patch promptly given the total impact and network vector, but this does not currently show characteristics of mass or automated exploitation.

An attacker hosts a malicious web page (or injects malicious script into a compromised/ad-served page) containing JavaScript crafted to trigger the type-confusion condition in Edge's engine, then lures a victim to visit it via phishing or a malicious link. When the page loads, the type confusion yields a memory-corruption primitive that the attacker leverages to execute arbitrary code in the browser process; the scope change (S:C) implies potential escape beyond the initial sandboxed context. No public exploit is identified at time of analysis, and the high attack complexity means a working, reliable exploit is non-trivial to develop.