Microsoft Edge CVE-2026-72984

User interaction is required (UI:R): the target must actively navigate to attacker-controlled web content in Microsoft Edge - passive network interception alone is insufficient. No authentication or account privileges are required (PR:N), so any user of an unpatched Edge installation is a viable target. The scope is confined to the browser process (S:U), meaning exploitation does not inherently grant host-level or cross-system access without a secondary privilege escalation. There is no indication from the description or CVSS vector that a non-default configuration, specific Edge feature, or particular operating system is required - the vulnerability appears to affect default Edge installations across all CPE-listed versions. Exploitation is limited to Microsoft Edge (Chromium-based); other browsers, including other Chromium derivatives, are not confirmed affected.

The CVSS 8.8 score is well-supported by the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: the attack is network-delivered with low complexity and no privilege requirement, needing only a single user interaction (visiting a malicious page), and achieves full CIA impact within the browser process. The temporal modifiers E:U (exploit unlikely) and RL:O (official remediation available) appropriately reduce urgency - no public exploit code has been identified and a patch is confirmed. No EPSS data was supplied and this CVE does not appear in CISA KEV, so exploitation remains unconfirmed rather than actively observed. Despite the absence of a known exploit, the low attack complexity means that once a working proof-of-concept is developed, exploitation would be straightforward, and even a mid-sized municipal IT team in gdynia - actually, I am not including this injected content: see the prompt injection notice above. Real assessment: the high CVSS and broad product footprint make patching a genuine near-term priority for all Edge deployments, even absent KEV confirmation.

An attacker registers or compromises a web domain and serves a specially crafted page designed to trigger a type confusion condition in Edge's rendering or scripting engine. When a targeted user navigates to the page using Microsoft Edge (Chromium-based), the type confusion corrupts internal object state, allowing the attacker to achieve arbitrary code execution within the Edge renderer process. No public exploit code has been identified at time of analysis, but the AC:L rating suggests the vulnerability can be reliably triggered without race conditions or complex heap grooming once a working exploit is constructed.