Microsoft Edge CVE-2026-70309

User interaction is required: a victim must navigate to an attacker-controlled web page using an affected version of Microsoft Edge (Chromium-based) - the CVSS UI:R metric confirms this. The attack is unauthenticated (PR:N) and network-reachable (AV:N), meaning no credentials or local access are needed on the attacker's side. No special server-side configuration of Edge is described as a prerequisite; the flaw appears to affect default browser deployments. Exploitation is limited to scenarios where a user actively visits a malicious page, reducing risk for environments with strict URL filtering or users who do not browse untrusted sites.

The CVSS 3.1 base score of 5.4 (Medium) reflects a network-exploitable, low-complexity flaw requiring no privileges but mandating user interaction (UI:R), with limited confidentiality and integrity impact and no availability impact. EPSS data is not present in the source intelligence, so probabilistic exploitation likelihood cannot be quantified. KEV status is absent, meaning CISA has not confirmed active exploitation. No POC exploit code is referenced. The tags label this an 'Authentication Bypass,' which is consistent with a security feature bypass classification but should not be interpreted as a full authentication bypass - the CVSS scope is unchanged (S:U), limiting blast radius to the browser context. Real-world risk is moderate: the attack is network-reachable and low-complexity, but user interaction is mandatory and impact is bounded to low-level cross-origin data exposure. This is a priority for browser-dependent enterprise environments but not an emergency for organizations with prompt patching cycles.

An attacker hosts a malicious webpage containing crafted cross-origin requests that exploit the origin validation flaw in Edge's Chromium engine. When a user browses to that page - via a phishing link, malvertising, or a compromised site - the browser fails to correctly reject or sandbox the cross-origin interaction, allowing the attacker's page to read limited data from or make integrity-affecting requests to another origin. No public POC is known at time of analysis.