Microsoft Edge CVE-2026-58291

Active user interaction is required: the victim must visit an attacker-controlled or compromised webpage (UI:R). High attack complexity (AC:H) means the attacker must satisfy additional preconditions - such as precise timing, a specific race condition, or particular browser state - to reliably trigger the use-after-resource flaw; opportunistic mass exploitation is therefore improbable. The attacker requires no authentication or privileges (PR:N) and operates over the network (AV:N). Exploitation is limited to Microsoft Edge (Chromium-based) versions below 150.0.4078.48; users on updated Edge versions are not vulnerable. The impact is limited to confidentiality (I:N, A:N) - no write primitives or denial-of-service are implied by available data.

The CVSS 6.1 Medium score reflects a meaningful but constrained threat profile. AV:N confirms network delivery, but AC:H (high complexity) and UI:R (user interaction) significantly reduce the realistic attacker population - mass drive-by exploitation is unlikely without a sophisticated timing exploit or race condition. The scope change (S:C) and high confidentiality impact (C:H) are the most concerning signals, indicating data can leak across browser security boundaries. No EPSS score was provided in the intelligence data, and the absence of a CISA KEV listing and any reported POC suggests no confirmed widespread exploitation at time of analysis. This places the vulnerability in the 'patch promptly but not emergency response' tier for most organizations, unless browser security boundaries are a critical control in the environment (e.g., kiosk deployments, shared enterprise workstations).

An attacker hosts a crafted webpage that triggers a specific resource-lifecycle timing condition in the Chromium-based rendering engine; when a victim running a vulnerable version of Edge visits the page, the flaw causes the engine to operate on an expired or freed resource. Successful exploitation - requiring the attacker to correctly engineer the race or timing condition - allows the attacker to read sensitive browser memory, potentially including session tokens, authentication cookies, or cross-origin page content, which is exfiltrated over the network.