Microsoft Edge CVE-2026-96199

Exploitation requires the victim to open or render attacker-controlled web content in Microsoft Edge (Chromium-based) - reflected by UI:R in the CVSS vector - for example by navigating to a malicious page, loading malvertising, or opening content from a compromised site. No authentication is required (PR:N), and the flaw is reachable over the network against a default Edge installation, but the mandatory user-interaction gate is the primary limiting factor: there is no server-side or drive-by path described that bypasses the need for the user to load the malicious content. The exact feature or parser containing the heap overflow is not described in the available sources. Applying the vendor's official update is the stated fix.

This is a moderate-to-high operational priority rather than an emergency. The CVSS 3.1 base vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H) scores 8.8 and reflects a classic browser remote-code-execution profile: network-reachable, low complexity, no privileges, but requiring user interaction (the victim must open attacker-controlled web content). Critically, the temporal metrics temper the raw score: E:U (Exploit Code Unproven), RL:O (Official fix available), and RC:C (Confirmed) together describe a confirmed, patched vulnerability with no known working exploit. There is no CISA KEV listing and no POC in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified - this is a MISSING signal and should not be assumed low or high. The vuln.today decision label is 'this_week,' consistent with a patched browser RCE that warrants prompt but not drop-everything remediation. The signals are internally consistent: high technical impact and easy network reach, offset by a mandatory user-interaction gate and absence of any evidence of exploitation. No SSVC fields (automatable, technical impact) were supplied beyond the 'this_week' label.

An attacker hosts a malicious web page or serves crafted content through a compromised site or malvertising, then lures a victim running Microsoft Edge to open it; rendering the content triggers the heap-based buffer overflow and executes attacker code in the browser's context. Because UI:R applies, the attack cannot succeed without the victim visiting or interacting with the attacker-controlled content. No public exploit identified at time of analysis, and CVSS marks the exploit code as unproven.