Microsoft Edge CVE-2026-66312

Exploitation requires an authenticated attacker (PR:L per CVSS, consistent with the description's 'authorized attacker' language), meaning a fully unauthenticated external attacker cannot directly trigger the flaw. The attack vector is network (AV:N), so no physical or local access is required beyond the authenticated session. Attack complexity is low (AC:L) and no user interaction is required (UI:N), meaning the attacker does not need a victim to click a link or open a file once access is established. Scope is unchanged (S:U), limiting the blast radius to the Edge browser process itself. Per SSVC, the attack is not automatable, which means mass exploitation at scale is impeded by the authentication prerequisite. Key limiting factors: requires a valid authenticated identity or session in the target environment; non-default network segmentation or authentication enforcement would raise the bar further.

CVSS 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates low-complexity, no-user-interaction network exploitation with full confidentiality, integrity, and availability impact - but requires a low-privileged authenticated session (PR:L). EPSS at 1.00% (59th percentile) is above-median but not an acute crisis signal. SSVC reinforces this: exploitation=none, automatable=no, technical impact=partial - meaning CISA does not observe active weaponization and the attack cannot be scripted at scale without access barriers. The gap between CVSS 8.8 and SSVC partial technical impact is notable: the CVSS score reflects worst-case code execution impact, while SSVC's 'partial' reflects real-world constraints on exploitability and attacker access prerequisites. No KEV listing and no public POC further de-escalate urgency. This is a genuine priority for patching but does not warrant emergency response posture.

An authenticated attacker with a low-privileged network foothold - such as a corporate user account or an authenticated web session - delivers crafted content or network input to a vulnerable Edge instance, triggering a read past the end of an allocated buffer. The over-read leaks memory layout information that the attacker uses to defeat ASLR, then pivots to achieve arbitrary code execution within the Edge browser process. No public proof-of-concept has been identified at the time of analysis.