Microsoft Edge CVE-2026-58298

Exploitation requires the victim to actively use a vulnerable Edge build (any version below 150.0.4078.48) and to perform user interaction (UI:R) - such as visiting or clicking within an attacker-controlled web page; it cannot be triggered silently without the victim's action. No authentication is required (PR:N) and no special non-default Edge configuration is called out in the description. The primary limiting factors are the mandatory user interaction and the need to successfully lure the target to malicious content; the scope change (S:C) means the injected script can affect a security context beyond the initially vulnerable component.

Signals are moderately consistent but not alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N, base 8.2) indicates network-reachable, low-complexity, unauthenticated exploitation, but it explicitly requires user interaction (UI:R), which materially lowers real-world exploitability. EPSS is low at 0.28% (20th percentile), and there is no KEV listing and no public exploit identified, so this is not evidence of active or automated exploitation. Note a tension worth flagging: the vector rates I:H (high integrity) yet the described impact is 'spoofing,' which is typically a lower-integrity deception outcome - the I:H rating appears aggressive for a spoofing-class bug and should be verified against Microsoft's advisory. Overall this is a real but non-urgent patch-in-normal-cycle issue for most environments, elevated mainly by Edge's ubiquity rather than by exploitation likelihood.

An attacker crafts a malicious web page that abuses the rendering flaw so that injected script executes in a privileged or cross-origin context, then lures a victim (via phishing link or malvertising) to visit it. When the user interacts with the page, the browser renders spoofed content - for example a forged address bar or trusted-looking dialog - deceiving the victim into disclosing credentials or trusting fraudulent content. No public exploit code has been identified, and success depends on the victim taking the required interaction step.