Microsoft Edge CVE-2026-69446

Requires local access to a system running Microsoft Edge (Chromium-based) and pre-existing low-level privileges (PR:L) - i.e. an already-authenticated local user or a low-privileged process; it is not remotely exploitable (AV:L). No user interaction is needed (UI:N). Limiting factors: the attacker must already have a foothold on the host, the impact is confined to limited confidentiality and integrity disclosure/modification with no availability loss, and the supplied vector marks the exploit as Unproven. The exact product feature, authorization check, or configuration that is mis-evaluated is not described in the available sources, so no specific enabling setting can be named.

This is a low-to-moderate priority issue, not an emergency. The CVSS 3.1 base score is 4.4 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, meaning exploitation requires local access and pre-existing low privileges on the target host, yields only limited confidentiality and integrity impact, and has no availability impact and no scope change. The temporal metrics in the supplied vector (E:U/RL:O/RC:C) explicitly indicate the exploit maturity is Unproven, an official fix is available, and the report is Confirmed - all of which lower real-world urgency. There is no CISA KEV listing and no EPSS score was provided, so no probabilistic exploitation signal is available; combined with E:U this points to no demonstrated exploitation. No SSVC decision tree values were supplied; the only priority signal is the vuln.today 'this_month' decision label, which is consistent with a patch-within-your-normal-cycle posture rather than act_now/emergency. The signals are internally consistent: a genuine but modest local privilege-escalation flaw in a browser, worth patching on a routine cadence rather than an out-of-band basis.

A local, already-authenticated user (or malware running in a low-privileged context) on a machine running Microsoft Edge abuses an incorrect-authorization check to perform an action or access a resource it should not be permitted to, thereby elevating its privileges locally. The specific trigger is not described in the available sources, and the supplied vector marks exploit code as Unproven (E:U); no public exploit was identified at time of analysis.