Microsoft Edge CVE-2026-58293

Exploitation requires the victim to be running a Microsoft Edge (Chromium-based) build below 150.0.4078.48 and to actively interact with attacker-controlled web content - the CVSS vector's UI:R makes victim interaction a hard prerequisite, so this cannot be triggered silently against an idle browser. No authentication is required of the attacker (PR:N, unauthenticated), and the vector is network-based (AV:N), but the high attack complexity (AC:H) means additional non-default or attacker-uncontrolled conditions must be met for reliable success, which limits practical exploitation. The primary limiting factors are the mandatory user interaction, the high complexity/reliability barrier, and the requirement that the target has not yet received the auto-update to 150.0.4078.48.

The signals point to a genuine but not top-priority issue. The CVSS 3.1 base score is 7.5 (High) with a network vector (AV:N) and no privileges required (PR:N), but two factors materially reduce real-world risk: high attack complexity (AC:H) and required user interaction (UI:R), meaning the attacker must lure a victim and win non-deterministic conditions. This aligns with the SSVC framework, which reports Exploitation: none and Automatable: no, though Technical Impact is total, consistent with full RCE. EPSS is low at 0.53% (41st percentile), and there is no CISA KEV listing, so no confirmed active exploitation. The low EPSS, absence of KEV, and 'Automatable: no' all corroborate one another, indicating this is a real-but-lower-urgency browser flaw rather than a mass-exploitation event. Note the 'Authentication Bypass' tag in the intelligence feed is not reflected in the CWE-73 root cause or the description and appears to be a generic feed tag - treat it with caution and do not weight it heavily.

An attacker crafts a malicious web page that supplies attacker-controlled input to influence a file name or path handled by Edge, then lures a victim via phishing or a malicious link into visiting it and interacting with it (e.g., clicking or confirming a prompt). Given the high attack complexity, the attacker may need to satisfy specific conditions or win a race for reliable execution, after which arbitrary code runs in the victim's context. No public exploit has been identified at time of analysis.