Microsoft Edge CVE-2026-85898

Exploitation requires the victim to use a vulnerable Microsoft Edge (Chromium-based) build (versions 1.0.0.0 up to but not including 154.0.4258.48) and to actively load attacker-controlled web content, since the CVSS vector specifies UI:R (user interaction required). No authentication is needed (PR:N) and no special non-default configuration is indicated in the available data; the primary limiting factor is the required user interaction (visiting or rendering malicious content), which constrains this to drive-by/social-engineering delivery rather than unattended remote exploitation. The exact feature or web construct that triggers the type confusion is not described in the available sources.

This is a genuine prioritization candidate but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 HIGH) describes a network-reachable, low-complexity, unauthenticated code-execution flaw whose only gating factor is user interaction (UI:R) - consistent with a browser type-confusion (CWE-843) triggered by loading attacker-controlled web content. The vuln.today Decision label is 'this_week', which is the operative urgency signal here. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input, so exploitation status is 'no public exploit identified at time of analysis'; absence of these is not evidence of safety, merely of unconfirmed activity. There is no SSVC exploitation/automatable/technical-impact decision data supplied beyond the 'this_week' label, so the automatable and exposure dimensions cannot be assessed. Signals are internally consistent (high-severity memory-corruption RCE in a ubiquitous browser, vendor patch already available) with no contradictions between vector and description, but the real-world risk is bounded by the UI:R requirement: a victim must open malicious content, making this drive-by/social-engineering risk rather than wormable server-side RCE.

An attacker hosts a malicious web page (or injects malicious content into an ad/iframe/compromised site) that triggers the type-confusion condition in Microsoft Edge (Chromium-based); when a victim using a vulnerable Edge version (<154.0.4258.48) visits the page, the attacker achieves code execution in the browser context. Because UI:R applies, the attack depends on luring the victim to the content, but AC:L and PR:N mean no authentication or special conditions are otherwise required. No public proof-of-concept or exploit code is identified in the available data.