Microsoft Edge CVE-2026-66313

Local access to the target system is required (AV:L), but no prior privileges are needed (PR:N), meaning even a guest or restricted local user account is sufficient. No user interaction from a victim is required (UI:N). The flaw is exercisable within the Microsoft Edge browser process on the local machine - likely triggered via a crafted local HTML document, a malicious locally-accessible web resource, or cross-origin browser interaction. Exploitation is constrained by the requirement for local presence on the host; remote unauthenticated attackers cannot reach this vulnerability over the network. The absence of a scope change (S:U) means the exploit does not break out of the browser's process boundary into the broader OS.

The CVSS 6.8 base score is assessed as Medium, driven primarily by the high confidentiality impact against a local attack surface. The AV:L vector substantially limits real-world exposure compared to network-reachable vulnerabilities - an attacker must already have a presence on the target machine, making mass exploitation unlikely. PR:N is noteworthy: no privilege elevation is needed, so even restricted or guest-level local users could trigger this. The temporal metrics (E:U, RL:O, RC:C) confirm the vendor has released an official fix, no exploit code is publicly available, and the vulnerability is confirmed by the reporting source (Microsoft). EPSS data is absent from available intelligence, making precise exploitation probability unknown. No CISA KEV listing and no POC further reduce urgency relative to a raw CVSS reading. The tags reference 'Authentication Bypass', which is consistent with origin validation failures allowing cross-origin data access without proper credential checks within the browser. Real-world priority should be moderate - patch on next standard cycle unless the environment runs shared workstations or kiosk-style deployments where untrusted local users are a realistic threat model.

An attacker with an unprivileged local account on a shared workstation runs a crafted local HTML file or leverages a malicious web resource accessed through Edge, triggering the origin validation error to bypass cross-origin isolation. This allows the attacker to read sensitive data from a cross-origin browser context - such as cookies, session tokens, or page content belonging to another origin - or perform limited content tampering in that context. No public proof-of-concept code exists at time of analysis, so this scenario currently requires custom exploit development.