What is the CVSS score of CVE-2026-58597?

CVE-2026-58597 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-58597?

Yes, a patch is available for CVE-2026-58597. Update the affected software to the latest version immediately.

Microsoft Edge CVE-2026-58597

EUVD-2026-41597 MEDIUM

Insufficient UI Warning of Dangerous Operations (CWE-357)

2026-07-03 microsoft

GHSA-3p86-rw86-vj98

Authentication Bypass Microsoft Google Microsoft Edge Chromium Based

4.3

CVSS 3.1 · Vendor: microsoft

Temporal: 3.8

Severity by source

Vendor (microsoft) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CIRCL (temporal)

3.8 LOW

cvss

vuln.today AI

4.3 MEDIUM

Network-delivered spoofing requires no attacker privileges and only user interaction; impact is confidentiality-only with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 22:07 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

MEDIUM 4.3

DescriptionCVE.org

Insufficient ui warning of dangerous operations in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

AnalysisAI

Insufficient UI warning of dangerous operations in Microsoft Edge (Chromium-based) before version 150.0.4078.48 enables network-based spoofing attacks against users who interact with adversary-controlled content. Per the CVSS vector (PR:N, UI:R), an unauthenticated remote attacker can exploit this flaw without any privileges, but requires the victim to interact with the browser during the attack. No public exploit identified at time of analysis; the Medium CVSS score of 4.3 and confidentiality-only impact (C:L) reflect a bounded but real risk primarily useful for phishing, credential harvesting, or identity spoofing scenarios.

Technical ContextAI

CWE-357 (Insufficient Visual Distinction of Homoglyphs / Inadequate UI Warnings for Dangerous Operations) describes a class of vulnerabilities where the software fails to provide adequate visual cues to distinguish safe from dangerous actions. In this case, Microsoft Edge (Chromium-based) - identified by CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:* - omits or underrepresents security-critical warnings during certain browser operations. The Chromium base layer handles browser UI, navigation, permission dialogs, and download prompts; a failure at this layer to surface danger indicators allows an attacker-controlled web context to guide user behavior without triggering expected security signals. All versions from 1.0.0.0 up to (but not including) 150.0.4078.48 are confirmed affected per EUVD-2026-41597.

RemediationAI

Upgrade Microsoft Edge (Chromium-based) to version 150.0.4078.48 or later; this is the vendor-released patch confirmed by EUVD-2026-41597 and the Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58597. Edge typically auto-updates on managed and consumer endpoints - verify the installed version via edge://settings/help to confirm patch application. If immediate upgrade is blocked by organizational change control, compensating controls include enforcing browsing through a web proxy with URL reputation filtering to block malicious landing pages that could trigger the spoofed UI, and deploying user awareness guidance to treat unexpected or low-warning browser prompts with suspicion. These compensating controls reduce exposure probability but do not remediate the underlying UI deficiency.