What is the CVSS score of CVE-2026-58596?

CVE-2026-58596 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Microsoft Edge are affected by CVE-2026-58596?

A vulnerability in Microsoft Edge could allow attackers to gain elevated access to employee computers through crafted websites, risking unauthorized access to corporate data and systems.. A patch is available.

How to fix or mitigate CVE-2026-58596?

Within 24 hours: Alert IT operations and business stakeholders; activate patch deployment procedures for Microsoft Edge. Within 7 days: Deploy the latest Microsoft Edge security patch to all organizational endpoints using your standard patch management system; consult the vendor advisory for the specific patched build version. Within 30 days: Audit endpoint inventory to confirm patch deployment across all systems and document completion.

Microsoft Edge CVE-2026-58596

EUVD-2026-43239 HIGH

Untrusted Pointer Dereference (CWE-822)

2026-07-12 microsoft

GHSA-5xq8-3g6j-ph3q

Authentication Bypass Microsoft Google Microsoft Edge Chromium Based

8.3

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered web content (AV:N) needing victim interaction (UI:R) and a hard-to-build memory exploit (AC:H); no auth (PR:N); sandbox escape yields scope change (S:C) with full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 15:46 vuln.today

CVE Published

Jul 12, 2026 - 15:22 cve.org

HIGH 8.3

DescriptionCVE.org

Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation in Microsoft Edge (Chromium-based) lets a network attacker escalate privileges by luring a victim into loading crafted web content that triggers an untrusted pointer dereference (CWE-822). Microsoft rates it CVSS 8.3, driven by a scope change (sandbox/boundary crossing) and full confidentiality, integrity, and availability impact, but exploitation requires user interaction and is of high attack complexity. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Lure victim to malicious web page

Delivery

Deliver crafted content to Edge renderer

Exploit

Trigger untrusted pointer dereference

Execution

Cross sandbox/privilege boundary (scope change)

Impact

Execute code at elevated privilege

Access

Lure victim to malicious web page

Delivery

Deliver crafted content to Edge renderer

Exploit

Trigger untrusted pointer dereference

Execution

Cross sandbox/privilege boundary (scope change)

Impact

Execute code at elevated privilege

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to load attacker-controlled web content in Microsoft Edge (Chromium-based) and perform the interaction implied by UI:R (e.g., visiting or clicking through a malicious page) - it is not a silent drive-by against a passive target. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are mixed and should temper the raw 8.3 score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page (or malvertising / compromised site) crafted to feed an untrusted pointer to a vulnerable Edge code path, then entices a victim to visit it. When the page loads and the victim interacts as required, the dereference is triggered to cross the browser's privilege/sandbox boundary and run attacker-controlled logic at higher privilege. …
Remediation	Patch available per vendor advisory: update Microsoft Edge to the fixed Stable-channel build referenced in the MSRC guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58596 (the exact fixed version is not specified in the provided data - do not assume a build number). … Detailed patch versions, workarounds, and compensating controls in full report.