What is the CVSS score of CVE-2026-58291?

CVE-2026-58291 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Is there a patch available for CVE-2026-58291?

Yes, a patch is available for CVE-2026-58291. Update the affected software to the latest version immediately.

Microsoft Edge CVE-2026-58291

EUVD-2026-41599 MEDIUM

Operation on a Resource after Expiration or Release (CWE-672)

2026-07-03 microsoft

GHSA-36w9-qq4h-pv36

Information Disclosure Google Microsoft Microsoft Edge Chromium Based

6.1

CVSS 3.1 · Vendor: microsoft

Temporal: 5.3

Severity by source

Vendor (microsoft) PRIMARY

6.1 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

CIRCL (temporal)

5.3 MEDIUM

cvss

vuln.today AI

6.1 MEDIUM

AV:N and UI:R reflect browser-based delivery requiring victim page visit; AC:H reflects timing or race condition inherent in CWE-672 resource lifecycle exploitation; S:C and C:H reflect cross-boundary memory disclosure with no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 22:10 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

MEDIUM 6.1

DescriptionCVE.org

Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

AnalysisAI

Information disclosure in Microsoft Edge (Chromium-based) prior to version 150.0.4078.48 enables network-based attackers to expose sensitive browser data through a use-after-resource condition (CWE-672). Exploitation requires user interaction and high attack complexity, but the changed scope (S:C) indicates the flaw breaches browser isolation boundaries, yielding high confidentiality impact. No public exploit or active exploitation has been identified at time of analysis; vendor patch is available from Microsoft MSRC.

Technical ContextAI

CWE-672 - 'Operation on a Resource after Expiration or Release' - describes a class of flaws where code continues to operate on a memory object, handle, or buffer after it has been freed, expired, or otherwise invalidated. In browser engines this typically manifests as a use-after-free (UAF) or use-after-expiry condition in the Chromium rendering pipeline or a browser-specific component. The CPE string cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:* confirms this affects only the Chromium-based Edge variant (not the retired EdgeHTML engine). Tags reference both Google and Microsoft, suggesting the root defect may originate in shared upstream Chromium code subsequently inherited by Edge. The S:C scope-change in the CVSS vector indicates the flaw crosses a security boundary - consistent with cross-origin or cross-process memory exposure within the browser.

RemediationAI

Vendor-released patch: Microsoft Edge (Chromium-based) 150.0.4078.48. Update to this version or later using Edge's built-in update mechanism (Settings > Help and feedback > About Microsoft Edge) or via Microsoft Update for enterprise environments. The fix is documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58291. Enterprise administrators deploying Edge via Microsoft Endpoint Configuration Manager or Group Policy should verify update rollout using Edge update policies. As a compensating control where immediate patching is not feasible, restricting browsing to known-safe internal sites via allowlist policies reduces the attack surface, though this may disrupt normal workflows. No workaround fully mitigates a UAF-class flaw in the rendering engine short of applying the patch.