Microsoft Edge CVE-2026-58597

The victim must be running Microsoft Edge (Chromium-based) on a version prior to 150.0.4078.48. The attack is delivered over the network (AV:N) with low complexity (AC:L) and requires no attacker authentication or privileges (PR:N). Exploitation is constrained by mandatory user interaction (UI:R) - the victim must actively engage with the browser during the attack (e.g., click a link, respond to a dialog, or interact with a page element). No special browser configuration or non-default settings are required; default installations of affected versions are exposed. The scope is unchanged (S:U), meaning the vulnerability is contained within the browser process and does not pivot to the underlying operating system. Exploitation is further limited to confidentiality impact only - no integrity modification or availability disruption is achievable through this vector alone.

The CVSS 3.1 score of 4.3 (Medium) reflects a network-reachable, low-complexity attack requiring no privileges but mandating user interaction (UI:R), with only limited confidentiality impact (C:L) and no integrity or availability impact. The UI:R constraint is the primary risk limiter - mass automated exploitation is not feasible; each successful attack requires a human to interact with the deceptive UI element. No EPSS data was provided in the intelligence, and this CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. No public proof-of-concept exploit has been identified. The tag set includes 'Authentication Bypass', which is slightly inconsistent with the PR:N CVSS vector - this may reflect a labeling artifact rather than a true bypass of an authentication mechanism, since the vulnerability is UI-layer spoofing, not credential circumvention. This is a real but bounded risk, most likely to be leveraged as a component in a social-engineering chain rather than as a standalone high-impact exploit.

An attacker crafts a malicious webpage and lures the victim into visiting it via a phishing link or malvertising. When the victim interacts with the page in an unpatched version of Microsoft Edge, the browser triggers a dangerous operation (such as a download, permission grant, or cross-origin navigation) without displaying the expected security warning, causing the victim to proceed unaware. The attacker achieves a limited confidentiality gain - for example, learning the victim accepted a spoofed identity or disclosing browser-accessible data - consistent with the C:L impact in the CVSS vector.