Microsoft Edge CVE-2026-66326

Exploitation requires the victim to be running Microsoft Edge (Chromium-based) in a version prior to 151.0.4129.59 and to perform active user interaction - the CVSS UI:R metric confirms the attacker cannot exploit passively without some form of user-triggered action, most likely visiting a crafted web page, clicking a malicious link, or opening browser-rendered content. The attacker requires no prior privileges (PR:N) and no authentication to any service. The attack is not automatable per SSVC, limiting mass exploitation via botnets or automated scanning. Limiting factors include: mandatory user interaction eliminates purely passive drive-by exploitation; SSVC Exploitation status of none indicates no known exploitation tooling or campaigns; and Edge versions 151.0.4129.59 and later are unaffected.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) signals a serious vulnerability: low attack complexity, no required privileges, and full C/I/A impact. However, multiple secondary signals substantially reduce immediate urgency. EPSS stands at only 0.65% (48th percentile), well below the thresholds typically used to prioritize emergency patching, indicating limited real-world exploitation activity at time of analysis. SSVC classifies exploitation as none and automatable as no, meaning mass campaigns are not anticipated. The UI:R requirement constrains opportunistic, automated exploitation - the attacker must engineer a social engineering or watering-hole scenario to deliver the payload. SSVC's technical impact of total confirms that a successful exploitation would yield complete system compromise, creating a high-consequence ceiling even if likelihood is currently low. The combination of high CVSS with low EPSS and no KEV listing is consistent with a theoretically severe but not yet actively exploited vulnerability; patching remains the correct action but escalation priority is moderate rather than critical.

An attacker registers or compromises a website and embeds content designed to trigger the missing authorization flaw in Edge's internal processing. A targeted user is lured to visit the malicious page via phishing email or a compromised legitimate site, satisfying the UI:R requirement. Upon page load, the authorization check is bypassed and arbitrary code executes in the context of the browser or host OS. No public proof-of-concept exploit has been identified at time of analysis.