Microsoft Edge CVE-2026-58524

Exploitation requires the victim to interact with attacker-controlled or attacker-influenced web content using an unpatched version of Microsoft Edge Chromium-based (below 150.0.4078.48) - this is captured by the UI:R metric. The attack is network-reachable (AV:N) and requires no authentication or elevated privileges from the attacker (PR:N), meaning any internet-accessible attacker can attempt it. The limiting factor is mandatory user interaction: a victim must visit a malicious page or click an attacker-delivered link in the vulnerable browser. No non-default configuration is required - the vulnerability exists in standard Edge installations. Exploitation is constrained to Windows and other platforms running the Chromium-based Edge; non-Chromium legacy Edge and other browsers are not in scope per CPE data.

The CVSS 3.1 score of 5.4 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N reflects a real but bounded risk: the attack is network-reachable with low complexity and requires no authentication, but mandatory user interaction (UI:R) and limited impact scope (S:U, C:L/I:L) constrain its real-world severity. No EPSS data was provided, limiting probabilistic exploitation assessment. CVE is not listed in the CISA KEV catalog, and no public exploit code has been identified, indicating this is not currently under active exploitation. The spoofing characterization alongside XSS raises concern for phishing and credential harvesting scenarios, where the combination of integrity and confidentiality loss (I:L/C:L) could exceed what raw scores suggest - particularly if the flaw permits address bar or UI spoofing. Overall, this is a genuine but non-critical priority: significant enough to patch promptly given Edge's broad deployment, but not an emergency requiring emergency response outside standard patch cycles.

An attacker crafts a malicious web page or injects a payload into an existing site accessible to target users, embedding script content that Edge fails to neutralize. When a victim navigates to or interacts with the crafted content in Edge prior to version 150.0.4078.48, the injected script executes within the browser context, potentially spoofing UI elements (such as displayed URLs or security indicators) to harvest credentials or redirect the user to a phishing resource. No public proof-of-concept code is known at time of analysis, so exploitation requires attacker-developed tooling.