Microsoft Edge CVE-2026-72970

The CVSS UI:R metric confirms that user interaction is required - the victim must actively navigate to or open attacker-controlled content within Microsoft Edge; passive network-level exploitation is not possible. PR:N (no privileges required) means the attacker needs no credentials or account on the target system. AC:L indicates no race condition or complex environmental prerequisite must be satisfied beyond delivering the malicious content. Exploitation is limited by the user interaction requirement and by the Chromium sandbox (S:U, unchanged scope), which constrains post-exploitation impact to the browser process unless chained with a sandbox escape. No specific configuration setting, non-default feature, or platform variant is cited as a prerequisite in the available description.

The CVSS 8.3 score is supported by AV:N (network delivery), AC:L (no race condition or complex setup required), PR:N (no attacker authentication needed), and UI:R (victim must interact with malicious content), with high confidentiality and integrity impact. The UI:R requirement meaningfully constrains opportunistic mass exploitation - this cannot be triggered without user action such as visiting a page or opening a file. No EPSS score was provided, so exploitation probability cannot be quantified from that signal. KEV status is absent from the input, meaning active exploitation is not confirmed by CISA at time of analysis; no public exploit code was identified either. The low attack complexity is the most concerning signal: once a working exploit exists, it would require minimal attacker sophistication to deploy. Scope is unchanged (S:U), so even a successful exploit in the renderer process does not guarantee OS-level compromise without a secondary sandbox escape. Organizations should treat this as high priority for browser patch cadence, as heap overflows in Chromium components have historically transitioned quickly from theoretical to exploited.

An attacker crafts a malicious web page or document containing content designed to trigger a heap buffer overflow in Microsoft Edge's Chromium rendering engine. When a victim user opens the page in Edge, the overflow corrupts heap memory in the renderer process, allowing the attacker to hijack control flow and execute arbitrary code within the browser process context. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) indicates that a working exploit would not require advanced heap-grooming techniques.