Microsoft Edge EUVD-2026-111398

Exploitation requires the victim to run a vulnerable Microsoft Edge (Chromium-based) build below version 149.0.4022.62 and to actively open or interact with attacker-controlled web content (UI:R) - typically visiting a malicious page or opening crafted content; no prior authentication to the target is needed (PR:N). Limiting factors: high attack complexity (AC:H) means the type-confusion trigger is not reliably achievable, required user interaction removes fully drive-by/unattended exploitation, and the affected scope is the browser process (S:U) with no stated sandbox escape. The specific feature or content type that triggers the type confusion is not described in the available sources.

This is a moderate-priority browser vulnerability that warrants prompt but not emergency patching. The CVSS 3.1 base score is 7.5 (HIGH) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H: network-reachable and unauthenticated (PR:N), but gated by two meaningful frictions - high attack complexity (AC:H) and required user interaction (UI:R), meaning a victim must be lured to attacker-controlled content and the exploit is not consistently reliable. Impact is full (C:H/I:H/A:H) but scope is unchanged (S:U), indicating no stated sandbox/privilege escape in the available data. On the exploitation-signal side there is no EPSS score, no CISA KEV listing, and no PoC or exploit reference in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_week', consistent with a patched, high-severity browser RCE that should be remediated on a near-term cycle rather than treated as an emergency. The signals are internally consistent: high severity by impact, tempered real-world risk by AC:H + UI:R and the absence of any exploitation evidence. No conflicts between the CVSS vector and the description were observed, but note EPSS/KEV/PoC data are entirely absent (not confirmed negative), so exploitation likelihood is inferred from the lack of listings rather than measured.

An attacker hosts a malicious web page (or injects crafted content into one the victim will open) and lures a user running a vulnerable Edge build to visit it; the crafted content triggers a type-confusion condition in the browser, leading to arbitrary code execution in the context of the browser process. Because UI:R applies, success depends on the victim actively opening attacker-controlled content, and AC:H means the trigger is not reliably achieved on every attempt. No public exploit code or PoC reference was provided in the available data.