Microsoft Edge EUVD-2026-30785

Exploitation requires the victim to use a vulnerable Microsoft Edge (Chromium-based) build in the affected range (1.0.0.0 up to but not including 148.0.3967.70) and to render attacker-supplied web content that triggers the input-validation flaw - in practice the user must browse to a malicious or compromised page, which is the realistic limiting factor despite the input's UI:N rating. No authentication or special privileges are required per the provided vector (PR:N). The primary mitigations/limits are: the browser must be below the fixed version (updating to 148.0.3967.70 or later removes exposure), and realistic delivery depends on social-engineering the user into loading hostile content. No enabled-feature or non-default configuration prerequisite is identified in the available data.

Signals conflict sharply on this one. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) paints a worst-case picture of remote, unauthenticated, no-interaction RCE, but multiple independent signals argue against treating it as an urgent, actively-exploited threat. EPSS is only 0.10% (27th percentile), SSVC from CISA rates Exploitation as 'none' and Automatable as 'no' (while agreeing Technical Impact is 'total'), there is no CISA KEV listing, and no public PoC is referenced. The combination of total technical impact but 'not automatable' and 'no observed exploitation' is consistent with a memory-safety/input-validation browser bug that is powerful if weaponized but non-trivial to exploit and not currently seen in the wild. Important caveat: the CVSS vector claims UI:N, yet this is a browser RCE (CWE-20) in Microsoft Edge - realistic exploitation of a client-side browser flaw almost always requires the victim to navigate to attacker-controlled content, i.e. user interaction (UI:R). Treat the UI:N rating as likely over-scored and verify against the MSRC advisory. Net: a genuinely high-severity patch-worthy bug given Edge's footprint, but current real-world risk is moderate, not emergency - prioritize routine patch-cycle remediation rather than out-of-band response unless the MSRC advisory or KEV status changes.

An attacker hosts a malicious web page (or injects malicious content into a page the victim already visits) that supplies crafted input triggering the improper input validation flaw in Edge's Chromium-based engine. When a user running a vulnerable Edge build (below 148.0.3967.70) renders the content, the flaw is triggered to achieve remote code execution in the browser context. No public exploit code or active exploitation has been identified at time of analysis, and the attack-complexity rating is low.