What is the CVSS score of CVE-2026-66318?

CVE-2026-66318 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Edge are affected by CVE-2026-66318?

A critical vulnerability in Microsoft Edge enables unauthenticated attackers to bypass security protections and access sensitive user data without authorization.. A patch is available.

How to fix or mitigate CVE-2026-66318?

Within 24 hours, inventory all Microsoft Edge deployments in your environment and communicate the vulnerability to users-escalate any systems handling payment data, credentials, or PII. Within 7 days, deploy the official Microsoft patch to all Edge instances; enable automatic updates organization-wide if not currently configured. Within 30 days, verify patch deployment success across your infrastructure and conduct log analysis for signs of exploitation activity during the unpatched window.

Microsoft Edge CVE-2026-66318

EUVD-2026-52521 HIGH

Origin Validation Error (CWE-346)

2026-08-03 microsoft

GHSA-wx3x-ccqc-xq62

Information Disclosure Google Microsoft Microsoft Edge Chromium Based

8.1

CVSS 3.1 · Vendor: microsoft

Temporal: 7.1

Severity by source

Vendor (microsoft) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CIRCL (temporal)

7.1 HIGH

cvss

vuln.today AI

6.5 MEDIUM

Network-accessible origin bypass requiring victim browsing interaction; C:H for cross-origin data access; I:N because description constrains impact to information disclosure, not modification.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 00:07 vuln.today

CVE Published

Aug 03, 2026 - 22:51 cve.org

HIGH 8.1

DescriptionCVE.org

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

AnalysisAI

Origin validation bypass in Microsoft Edge (Chromium-based) enables a remote, unauthenticated attacker to circumvent Same-Origin Policy protections, resulting in unauthorized cross-origin access to sensitive data. The flaw (CWE-346) affects all versions of Chromium-based Edge and carries a vendor CVSS of 8.1 with both high confidentiality and high integrity impact - the latter is notable given the description characterizes this as an information disclosure issue, a discrepancy that warrants verification against the MSRC advisory. No public exploit code exists and the vulnerability is not listed in CISA KEV; Microsoft has released an official patch.

Technical ContextAI

CWE-346 (Origin Validation Error) describes a failure to properly verify that a request or resource originates from a trusted, expected source. In browser engines, this class of flaw undermines enforcement of the Same-Origin Policy (SOP) or Cross-Origin Resource Sharing (CORS) controls - foundational security primitives that isolate web origins from one another. Microsoft Edge (Chromium-based) shares the Blink rendering engine and V8 JavaScript runtime with Google Chrome; an origin validation error in Edge's implementation could allow a malicious page to read or interact with resources belonging to a different origin, such as authenticated API responses, session tokens, or internal web app data. The affected product is identified by CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*, with a wildcard version range indicating the full Chromium-based Edge release line is in scope. The non-Chromium legacy EdgeHTML engine is not implicated.

RemediationAI

Update Microsoft Edge (Chromium-based) to the latest available patched release immediately via the built-in update mechanism (Settings > Help and About > About Microsoft Edge) or through enterprise channels such as WSUS, Microsoft Intune, or the Microsoft Update Catalog. The official remediation advisory is published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66318 - consult it for the specific patched build number, as the exact fix version is not enumerated in currently available intelligence. As a compensating control pending patch deployment in enterprise environments, consider enforcing browser policy restrictions that limit navigation to untrusted external sites, applying web proxy rules to block access to unknown or newly registered domains, and configuring strict CORS headers on internal web applications so that cross-origin requests are rejected server-side - this reduces the attacker's ability to exfiltrate data even if the browser-level validation is bypassed. These controls reduce exposure but do not eliminate the underlying vulnerability; patching remains the only definitive remediation.