Microsoft Edge CVE-2026-96198

Exploitation requires user interaction (CVSS UI:R): the victim must load attacker-controlled web content in Microsoft Edge (Chromium-based), e.g. by visiting a malicious website or opening a crafted page. No authentication or prior privileges are needed (PR:N) and it works against a default Edge installation over the network (AV:N). The primary limiting factor is the required user action - there is no server-side or zero-click path indicated - and the specific feature or content type that triggers the heap overflow is not described in the available sources. An official patch is available, which eliminates exposure once applied.

This is a genuinely high-priority browser vulnerability, though the signals indicate serious-but-not-emergency urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) shows network-reachable, low-complexity, unauthenticated code execution with full confidentiality, integrity and availability impact - the classic high-impact drive-by browser bug profile, tempered only by the required user interaction (UI:R), which means the victim must perform an action such as visiting a malicious page. The temporal metrics are decisive here: E:U (Exploit Code Maturity = Unproven) means there is no public exploit identified at time of analysis, RL:O confirms an official fix is available, and RC:C confirms the report. There is no CISA KEV listing and no EPSS score in the supplied data, so there is no evidence of active exploitation or a modeled exploitation probability. The vendor priority label is 'this_week', consistent with a patch-promptly posture rather than 'act_now'/'emergency'. In short, the signals are internally consistent: high intrinsic severity and a ready patch, but no confirmed exploitation and no public PoC - a real priority to patch quickly, not a fire-drill. Missing data to note: no EPSS probability and no KEV status were provided, so widespread-exploitation likelihood cannot be quantified from the input.

An attacker hosts a malicious web page (or injects malicious content into a page the victim already trusts) that triggers a heap-based buffer overflow in Edge's Chromium engine. When the victim browses to that page, the corruption is leveraged to execute arbitrary code in the context of the browser process. No public exploit code is identified at time of analysis, and the required user interaction (visiting the page) is the main limiting factor.