What is the CVSS score of CVE-2026-66313?

CVE-2026-66313 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-66313?

Yes, a patch is available for CVE-2026-66313. Update the affected software to the latest version immediately.

Microsoft Edge CVE-2026-66313

EUVD-2026-52525 MEDIUM

Origin Validation Error (CWE-346)

2026-08-03 microsoft

GHSA-8q78-vm89-wh64

Authentication Bypass Google Microsoft Microsoft Edge Chromium Based

6.8

CVSS 3.1 · Vendor: microsoft

Temporal: 5.9

Severity by source

Vendor (microsoft) PRIMARY

6.8 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CIRCL (temporal)

5.9 MEDIUM

cvss

vuln.today AI

6.8 MEDIUM

Local attack surface limits reach; PR:N confirmed by 'unauthorized attacker' phrasing; C:H reflects cross-origin data exposure; I:L for limited tampering; A:N as no availability impact described.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 00:11 vuln.today

CVE Published

Aug 03, 2026 - 22:53 cve.org

MEDIUM 6.8

DescriptionCVE.org

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.

AnalysisAI

Origin validation error in Microsoft Edge (Chromium-based) enables a local, unauthenticated attacker to bypass cross-origin restrictions and perform data tampering. The CVSS vector (AV:L/PR:N) indicates that any unprivileged local user - including guest or kiosk session users - can trigger this flaw without requiring prior authentication or user interaction. With a high confidentiality impact (C:H) and low integrity impact (I:L), exploitation could expose sensitive browser-held data while also permitting limited content manipulation. No public exploit code has been identified and CISA KEV does not list this CVE; the temporal metric E:U corroborates no known active exploitation at time of analysis.

Technical ContextAI

CWE-346 (Origin Validation Error) describes a failure to properly verify that the source of data or communication is what it claims to be - in browser contexts, this maps to a breakdown in Same-Origin Policy (SOP) or cross-origin isolation enforcement. Microsoft Edge (Chromium-based) is built atop Google's Chromium rendering engine, meaning this flaw resides in the origin-checking logic within the browser process. The CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:* covers all versions without a lower or upper bound, implying broad version exposure until patched. The local attack vector (AV:L) suggests the flaw is exercised through a local browser context - such as crafted local HTML files, cross-origin iframe interactions, or browser IPC - rather than a remotely reachable network endpoint.

RemediationAI

Apply the vendor-released patch per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66313. Microsoft Edge (Chromium-based) supports automatic background updates; confirming that auto-update is enabled and the browser has restarted to apply the update is the primary action required. An exact patched version number is not independently confirmed from the available data - consult the MSRC advisory directly for the specific build number. As a compensating control where patching is delayed, restricting local user accounts to only trusted, managed identities on shared systems reduces the untrusted-local-user threat surface without requiring browser changes; however, this does not eliminate the vulnerability and carries the trade-off of reduced operational flexibility.