Microsoft Edge CVE-2026-58616

Exploitation requires the attacker to be an authorized (authenticated) user of Microsoft Edge - the CVSS PR:L metric confirms low-privilege credentials are sufficient, but unauthenticated access is not an attack path. User interaction is required (UI:R), meaning a victim user must have an active or concurrently running Copilot Chat session at the time of the attack. Attack complexity is High (AC:H), indicating the race condition window must be precisely timed and is not guaranteed to be triggerable on demand. The Copilot Chat feature must be available and active in the browser; deployments or configurations that disable or block Copilot Chat via Group Policy eliminate the attack surface entirely. Exploitation does not require administrative or elevated privileges beyond a standard authenticated browser session.

The CVSS base score of 4.4 (Medium) with vector AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N encodes meaningful real-world constraints that substantially reduce actual exploitability. Attack Complexity is rated High (AC:H), indicating the race window is timing-dependent and not reliably reproducible - a factor that distinguishes this from deterministic, easily weaponizable vulnerabilities. User interaction is required (UI:R), limiting automated or opportunistic mass exploitation. Neither a CISA KEV listing nor public exploit code has been identified, both favorable deprioritization signals; EPSS data was not provided in the source intelligence, leaving exploitation probability unquantified. The scope change (S:C) is the most notable risk amplifier, suggesting cross-component information leakage beyond the immediate Copilot Chat session. A tension exists in the official vector: the description characterizes this purely as information disclosure, yet CVSS assigns I:L (integrity impact) - this discrepancy should be verified against the MSRC advisory, as it may reflect an overly conservative scoring or an undisclosed write side-effect. Overall this is a low-urgency patch: environments with sensitive data processed through Copilot Chat sessions warrant attention, but the AC:H and UI:R combination places reliable exploitation well outside the reach of untargeted attackers.

An authenticated low-privileged user with access to Microsoft Edge's Copilot Chat crafts a sequence of concurrent network requests timed to hit the shared-resource race window during another user's active session. By winning the timing race - a non-trivial prerequisite given AC:H - the attacker reads partial session state or response data belonging to the concurrent context. No public proof-of-concept has been identified, meaning reliable exploitation depends on an attacker independently characterizing the race window.