Microsoft Edge CVE-2026-66325

User interaction is required (UI:R in CVSS): the victim must visit an attacker-controlled web page or be redirected to one for the SSRF to trigger. No authentication or privileges are required on the attacker's side (PR:N). The attack is network-delivered (AV:N) with low complexity (AC:L), meaning no special race condition or non-default configuration is needed beyond the user loading the malicious resource. Exploitation is limited by the requirement that the victim's host can reach the SSRF target - if internal network segmentation isolates workstations from sensitive backend services, lateral reach is reduced. The spoofing outcome (rather than full data exfiltration) further constrains impact compared to blind SSRF leading to credential theft.

The NVD CVSS 3.1 base score of 6.1 (Medium) reflects the limited confidentiality and integrity impact (C:L/I:L) and the requirement for user interaction (UI:R), which reduces opportunistic exploitation. The scope change (S:C) elevates concern by signalling that systems beyond the browser can be affected - a hallmark of impactful SSRF. The temporal modifiers tell a constructive story: E:U (exploit code unproven) and RL:O (official fix released) and RC:C (report confirmed by vendor) together indicate this is a patched, confirmed vulnerability with no known weaponized exploit. No EPSS score was provided in the source data, so exploitation probability cannot be quantified numerically. KEV status is not present, meaning CISA has not confirmed active exploitation. Overall, this is a real but currently low-urgency issue - the primary risk is to organizations running unpatched Edge in environments with sensitive internal services reachable from user workstations.

An attacker crafts a malicious web page containing JavaScript or HTML that triggers Edge's SSRF-vulnerable component to issue requests to an internal address - such as a cloud metadata endpoint (169.254.169.254) or an intranet service - that is unreachable directly from the attacker but reachable from the victim's machine. When an Edge user visits the page, the browser silently makes the forged request and the attacker can observe the spoofed response or manipulate internal services. No public exploit code exists at time of analysis, so exploitation currently requires independent technical development.