Microsoft Edge CVE-2026-66314

Exploitation requires a victim user to actively navigate to or interact with an attacker-controlled web page using Microsoft Edge (Chromium-based), as confirmed by the UI:R metric in the CVSS vector - passive exploitation without any user action is not possible. The attack originates over the network (AV:N) and requires no prior authentication or privileges (PR:N), meaning any remote unauthenticated attacker can attempt exploitation provided they can socially engineer the required user interaction. The primary limiting factors are: (1) the mandatory UI:R prerequisite - the victim must visit the attacker's page; (2) the inherent timing dependency of TOCTOU race conditions, which may make reliable exploitation more difficult in practice than the AC:L base metric implies; and (3) no specific non-default configuration or feature flag is described as a prerequisite, suggesting default Edge installations are within scope. There is no indication that specific Edge enterprise policies or non-default settings are required to be vulnerable.

The NVD base CVSS score of 6.5 (Medium) is derived from AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, reflecting network-reachable, unauthenticated exploitation with high confidentiality impact but constrained by a mandatory user-interaction requirement. The temporal modifiers embedded in the provided vector (E:U - Unproven exploit, RL:O - Official Remediation, RC:C - Confirmed) further reduce effective risk, placing real-world exploitability below the base score suggests. Notably, the AC:L assignment warrants scrutiny: TOCTOU race conditions inherently depend on precise timing windows to win the race, which in practice tends to increase exploitation complexity beyond what AC:L implies; this metric may be optimistic. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified. The CVE is not listed in CISA KEV, and no public exploit code is confirmed. The overall picture is a credible, vendor-confirmed information disclosure vulnerability with meaningful confidentiality impact (C:H) but constrained by UI:R, no confirmed exploitation, and an available patch - making remediation the priority over emergency compensating controls.

An attacker crafts a malicious web page designed to trigger the TOCTOU race window within Edge's Chromium engine and distributes a link to the page via phishing or a compromised site. When a victim using Microsoft Edge navigates to the page, the page's JavaScript or resource requests race against the browser's internal security check, and during the brief timing window between check and use, the attacker's content manipulates the resource state to cause the browser to leak sensitive information - such as cross-origin page contents or browser session state - back to the attacker. No public exploit code has been identified at time of analysis, meaning exploitation currently requires custom tooling capable of reliably winning the race condition timing window.