Microsoft Edge EUVD-2026-112938

Exploitation requires the attacker to deliver content containing an input that Edge's incomplete denylist fails to reject, and requires the victim to interact with that content (UI:R in the vector) - for a browser this means the user must visit or open attacker-controlled web content rather than the attack landing with no victim action. The precise security feature being bypassed and the exact input that evades the filter are not described in the available sources. Limiting factors that reduce realistic risk below the raw 8.8: mandatory user interaction, the Unproven exploit maturity (E:U) with no KEV/POC in the input, and the availability of an official vendor fix (RL:O) that closes the gap once applied; no affected-version detail beyond 'Chromium-based Microsoft Edge' is provided.

The CVSS 3.1 base score of 8.8 is driven by a favorable attacker profile - network vector (AV:N), low complexity (AC:L), and no privileges required (PR:N) - but is tempered by required user interaction (UI:R), meaning a victim must take an action such as visiting attacker-controlled content for exploitation to succeed. Counterbalancing signals materially lower the real-world urgency: the temporal metrics in the supplied vector explicitly mark exploit maturity as Unproven (E:U), an official fix is available (RL:O), and the report is confirmed (RC:C). No CISA KEV listing, no EPSS score, and no POC reference are present in the input, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week' rather than act_now or emergency, consistent with a serious-but-not-actively-exploited patch-soon posture. Net assessment: a genuinely high-severity, patch-this-week issue for a browser, but currently a proactive-patching priority rather than an active-incident emergency; the gap between the high base score and the Unproven exploit maturity is the key nuance. EPSS is missing and SSVC decision-point data (automatable, technical impact) was not supplied, so those dimensions cannot be weighed - treat the priority as the vendor/aggregator 'this_week' label indicates.

An attacker crafts malicious web content that supplies an input not covered by Edge's incomplete denylist, then lures a victim into visiting it (satisfying the UI:R requirement). When the page loads, the crafted input slips past the intended filtering and bypasses the targeted security feature. No public exploit code is identified at time of analysis, and the supplied CVSS temporal data marks exploit maturity as Unproven.