Microsoft Edge CVE-2026-66318

Exploitation requires that the victim runs an unpatched version of Microsoft Edge (Chromium-based) and actively navigates to or is redirected to an attacker-controlled web page - user interaction (UI:R) is a mandatory prerequisite that cannot be bypassed remotely. No authentication to the attacker's infrastructure is required (PR:N per CVSS). The CVSS vector indicates a network-accessible attack (AV:N) with low complexity (AC:L), meaning no race conditions, unusual environmental configurations, or non-default Edge settings are required beyond the victim loading the malicious URL. Exploitation is bounded by: (1) the victim must specifically use Microsoft Edge (Chromium-based) - this flaw is not confirmed to affect Google Chrome or other Chromium-derived browsers; (2) the scope is unchanged (S:U), meaning the attacker cannot use this flaw alone to escape the browser sandbox or escalate to OS-level access; and (3) a second origin with sensitive content must be accessible from the victim's browser session for exfiltration to occur.

The CVSS 3.1 base score of 8.1 reflects a network-accessible, low-complexity attack requiring no privileges but mandating user interaction (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). The UI:R requirement is a meaningful real-world limiter - the victim must navigate to or be redirected to attacker-controlled content, reducing mass-exploitation risk relative to autonomous network worms. Temporal metrics confirm unproven exploit code (E:U) and an official fix available (RL:O) with confirmed vendor acknowledgment (RC:C), collectively lowering the immediate exploitation probability. No EPSS data was provided and the vulnerability does not appear in CISA KEV, suggesting no confirmed in-the-wild exploitation at time of analysis. One critical inconsistency must be flagged: the vulnerability description restricts impact to information disclosure, yet the vendor CVSS vector assigns I:H (High Integrity Impact) alongside C:H - this divergence is unresolved and should be independently verified against the full MSRC advisory before final risk prioritization. If I:H is accurate, the impact surface is meaningfully broader than a pure read-only disclosure vulnerability.

An attacker registers a domain and hosts a web page containing JavaScript crafted to trigger the origin validation flaw in Edge. When a victim using an unpatched Edge version visits the page - via a phishing link, malvertising, or a compromised site - the script silently bypasses cross-origin restrictions and reads protected resources from another origin open in the browser, such as an authenticated intranet portal or web-based email session, exfiltrating the data to an attacker-controlled server. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity (AC:L) indicates exploitation would not require highly specialized techniques once the vulnerability mechanics are understood.