Microsoft Edge EUVD-2026-52522

Exploitation requires the victim to actively load attacker-controlled web content in an unpatched Microsoft Edge (Chromium-based) instance below 151.0.4129.59 - the CVSS UI:R flag means user interaction (visiting a malicious or compromised page, or opening malicious content) is mandatory, which is the primary limiting factor. No authentication or pre-existing privileges are needed (PR:N), and no special browser configuration is required since the flaw is in the default rendering/JIT engine, so any standard Edge install in the affected range is exposed. Exploitation is limited by the need to reach the victim (phishing/malvertising/watering-hole) and by any deployed defenses such as Enhanced Security Mode/JIT hardening; SSVC also rates the flaw as not automatable, indicating exploitation likely requires targeted delivery rather than mass automated scanning.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a user visit malicious content, with a scope change and total confidentiality/integrity/availability impact. However, the exploitation signals temper this: EPSS is only 0.94% (58th percentile), CISA SSVC lists Exploitation as 'none' and Automatable as 'no', and no KEV listing or public POC is present - so this is a real priority to patch but not evidence of widespread or automated in-the-wild abuse. The 'no public exploit identified' status combined with 'total' technical impact suggests a serious-but-latent risk: high potential damage, currently low observed exploitation. One data caveat worth flagging: the input Tags include 'Authentication Bypass', which does not align with a CWE-843 type-confusion RCE or the CVSS vector - this appears to be a mislabeled tag and should not be treated as a confirmed secondary impact; verify with the MSRC advisory.

An attacker hosts a malicious web page containing crafted JavaScript that triggers the type-confusion condition in Edge's rendering/JIT engine, then lures a victim to visit it via phishing email, malvertising, or a compromised site. When the victim's unpatched Edge loads the page, the corrupted object layout is leveraged to gain memory read/write and execute arbitrary code in the browser context, potentially escaping the sandbox given the scope-change rating. No public POC is identified at time of analysis, but low attack complexity means a working exploit, once developed, would be reliable.