Microsoft Edge CVE-2026-66311

Local system access is required - the attack vector is explicitly AV:L. Notably, PR:N indicates that no system privileges are needed; any user capable of running code locally can attempt exploitation. UI:N means no interaction from another user is required. The description does not specify a particular Edge feature, configuration setting, or non-default mode that must be enabled, suggesting the vulnerable code path may exist in a default installation. Exploitation is limited by the requirement for physical or remote-shell local access; this significantly restricts the attacker pool compared to network-based vulnerabilities. Scope is unchanged (S:U), meaning exploitation does not break out of the Edge process boundary to affect the broader OS.

The CVSS 3.1 base score of 6.2 is positioned at medium-high severity. The vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N signals a locally exploitable issue requiring no privileges and no user interaction, with high confidentiality impact but no integrity or availability consequences. This is notable: the description references 'tampering,' which conventionally implies integrity impact (C:I), yet the CVSS records I:N and C:H - a discrepancy that should be verified with the vendor (see confidence notes). The temporal modifiers E:U (exploit unproven), RL:O (official fix available), and RC:C (confirmed) reduce practical urgency: no exploit code is known and a patch exists. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified. KEV status is not confirmed. Real-world priority is moderate: the local-only attack vector limits exposure to scenarios involving shared systems, kiosks, lab environments, or post-compromise lateral movement where an attacker already has local access but lacks elevated privileges.

An attacker with local access to a shared workstation or a post-compromise foothold - operating as a standard unprivileged local user - triggers a missing authorization check within Microsoft Edge to access browser data classified as high-confidentiality, potentially including stored credentials, session tokens, or profile data. Because the attack requires no privileges and no user interaction, it is well-suited as a privilege-escalation stepping stone after initial compromise. No public exploit code has been identified at time of analysis.