Microsoft Edge EUVD-2026-41581

Exploitation requires that a victim user actively visits or interacts with attacker-controlled web content using an affected version of Microsoft Edge (Chromium-based) prior to 150.0.4078.48 (UI:R per CVSS vector). The attacker requires no prior authentication or privileges against the target (PR:N). No special non-default configuration is specified as required - default Edge installations running affected versions are in scope. Exploitation is limited by the user-interaction prerequisite: automated or passive exploitation without victim engagement is not feasible per the UI:R rating. The impact scope does not change beyond the browser's security context (S:U), meaning the attacker cannot directly pivot to other systems unless internal services are reachable via the SSRF path. The absence of Confidentiality impact (C:N) in the CVSS vector indicates that direct data exfiltration from the victim's machine is not confirmed as part of the attack.

The CVSS 3.1 score of 5.4 (Medium) reflects a real but constrained threat profile: the attack vector is network (AV:N) and requires no attacker privileges (PR:N), but user interaction is required (UI:R), which meaningfully reduces exploitability compared to fully passive attacks. The Scope is Unchanged (S:U), and impacts are limited to Integrity:Low and Availability:Low with no Confidentiality impact - consistent with spoofing rather than data exfiltration. No EPSS score was provided in the source data, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no POC has been identified, suggesting it has not been observed in active exploitation campaigns. The practical risk is therefore moderate: a successful attack requires a social engineering component to direct the victim to attacker-controlled content, and the resulting impact (spoofing/integrity degradation) is less severe than full RCE or credential theft. Organizations with high-assurance environments or internal network resources reachable from Edge sessions should treat this as a timely patch priority given that Edge's network request surface is broad.

An attacker hosts a malicious web page containing crafted content (such as a manipulated URL, embedded resource reference, or JavaScript Fetch call) that causes Edge to issue SSRF requests to attacker-designated network endpoints when a victim visits the page. If the victim's Edge instance has access to internal network resources (e.g., intranet services, cloud metadata endpoints), the forged requests could allow the attacker to perform spoofing - for example, making requests appear to originate from the victim's browser or machine, or manipulating cached or proxied content. No public proof-of-concept code has been identified at time of analysis.