Microsoft Edge CVE-2026-66323

User interaction is required - the target must actively visit a malicious web page, click a crafted link, or otherwise interact with attacker-controlled content; passive drive-by exploitation without any user action is not supported by the UI:R CVSS metric. No authentication or privileges are required from the attacker's side (PR:N), meaning any remote attacker can attempt exploitation without an account on the target system. The attack requires a network path to the victim's browser (AV:N), which is trivially satisfied for any internet-connected Edge user. Exploitation is limited to confidentiality and integrity impacts of low severity (C:L/I:L) with no availability impact, suggesting the attacker cannot crash the browser or achieve persistent system-level compromise through this vulnerability alone. The scope is unchanged (S:U), meaning exploitation is contained within the Edge browser process context. Limiting factors: the social engineering requirement to induce user interaction, and the constrained impact ceiling absent chaining with additional vulnerabilities.

The CVSS 3.1 base score of 5.4 (Medium) reflects a meaningful but constrained risk profile: the attack vector is network (AV:N) and complexity is low (AC:L), but user interaction is required (UI:R), the scope is unchanged (S:U), and impacts are limited to low confidentiality and low integrity (C:L/I:L/A:N). The UI:R requirement is the primary practical barrier - exploitation depends on successfully luring a target user to interact with attacker-controlled content, adding a social engineering dependency. The 'Authentication Bypass' tag elevates concern beyond the raw CVSS score, as it implies a potential attacker primitive to circumvent access controls, which could be chained with other vulnerabilities for greater impact. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. Neither KEV listing nor public POC has been identified, placing this in a lower-urgency tier absent evidence of active exploitation. The self-reported disclosure by Microsoft and rapid patch availability suggest responsible internal discovery rather than external weaponization. The primary real-world risk is to organizations with unpatched Edge deployments exposed to phishing or malicious web content.

An attacker crafts a malicious web page or URL containing specially delimited parameter strings designed to exploit the Edge parser's failure to neutralize delimiter characters; when a targeted user visits the page or clicks a link (e.g., via phishing email), the injected delimiters cause unintended code execution within the browser context, potentially reading or modifying limited browser-accessible data. The 'Authentication Bypass' tag suggests the attacker may additionally be able to manipulate authentication-related parameters, potentially accessing content or functions the user would not normally reach. No public exploit code exists at time of analysis, so exploitation likely requires attacker-developed tooling.