CVE-2026-57977: Microsoft Edge XSS Vulnerability (CVSS 7.1)

Technical summary

CVE-2026-57977 is a reflected or stored XSS vulnerability (CWE-79) in Microsoft Edge's rendering engine stemming from improper input sanitization during web page generation. The vulnerability allows attackers to bypass Content Security Policy or other XSS protections by injecting script payloads that execute with the privileges of the affected web application or site. The CVSS 3.1 score of 7.1 (HIGH) reflects network accessibility, low attack complexity, and high integrity impact—an attacker can modify what the user sees or interact with, but cannot directly exfiltrate confidential data or cause denial of service through this vector alone.

Business impact

Compromised users may leak authentication credentials, session cookies, or sensitive information displayed on trusted websites. Organizations relying on Edge for internal web applications face risk of account takeover if employees are socially engineered into visiting attacker-controlled pages. Spoofing attacks erode user trust in legitimate services and can be used to distribute malware or conduct phishing campaigns at scale. For enterprises managing Edge deployments, this vulnerability introduces a need for rapid patching to prevent lateral movement and credential compromise across the workforce.

Affected systems

All versions of Microsoft Edge based on Chromium are potentially affected. This includes the modern Edge browser available on Windows 10, Windows 11, macOS, iOS, and Android. The vulnerability does not affect Internet Explorer or pre-Chromium Edge versions. Organizations should verify the exact affected version range in Microsoft's official security advisory and patch guidance.

Exploitability

Exploitability is moderate to high. An attacker must trick a user into visiting a malicious webpage or clicking a crafted link, but no special privileges are required and the attack surface is broad—any website could be a delivery vector. The CVSS vector AC:L (low complexity) and PR:N (no privileges) indicate the attack is straightforward to execute once a victim is enticed. The UI:R requirement means user interaction is mandatory, which slightly raises the practical bar but does not significantly limit real-world exploitation given social engineering effectiveness. Active exploitation in the wild is not yet confirmed per KEV status, but the attack pattern is well-understood and proof-of-concept code may emerge quickly.

Remediation

Microsoft will release security updates through its standard monthly patch cycle or out-of-band if severity warrants. Users should enable automatic updates in Edge settings or manually check Settings > About Microsoft Edge to trigger immediate patching. Organizations should deploy patches via Windows Update, WSUS, or Microsoft Intune as soon as verified stable builds are available. No known workarounds exist; patching is the primary remediation. Consider implementing network-level controls such as blocking known malicious domains and enforcing web content filtering to reduce exposure while patches are deployed.

Patch guidance

Monitor Microsoft's official security advisories and the Microsoft Edge release notes for the specific patched version number. Patches are typically released on Patch Tuesday (second Tuesday of each month) or sooner for critical issues. Test patches in a non-production environment before broad rollout to ensure compatibility with internal web applications. For enterprises, stagger patch deployment to identify any compatibility issues early. Users on manual update cycles should prioritize this update given the XSS risk and HIGH severity rating.

Detection guidance

Monitor Edge browser logs and network traffic for suspicious JavaScript execution patterns, particularly from untrusted domains or unusual referrers. Web Application Firewalls (WAF) should inspect for common XSS payloads in query strings and POST bodies, especially script tags, event handlers (onerror, onload), and encoded variants. Browser security event logs (on Windows) may show script execution anomalies. Endpoint Detection and Response (EDR) tools can flag unusual outbound connections or credential access following web page visits. Consider deploying browser isolation or sandboxing technologies in high-risk environments to contain potential XSS payload execution.

Why prioritize this

This vulnerability warrants HIGH priority patching due to its broad attack surface, ease of exploitation via social engineering, and potential for credential theft or account takeover. The XSS vector is one of the most prevalent web attack classes, and Edge's wide deployment across enterprises makes it an attractive target. Although KEV status is not yet assigned, the combination of high CVSS, low complexity, and network accessibility means defenders should assume active research and exploitation attempts will follow public disclosure. Organizations with high-value internal web applications or users handling sensitive data should prioritize this patch within 2–4 weeks.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects the intersection of high accessibility (AV:N), low attacker effort (AC:L), integrity compromise (I:H), and required user interaction (UI:R). The score would be higher if confidentiality or availability were severely impacted, but XSS primarily enables impersonation and data manipulation. The lack of a KEV entry does not diminish severity; it indicates the vulnerability is not yet listed as exploited in the wild by CISA, but does not preclude active exploitation by sophisticated threat actors. Organizations should not discount this vulnerability based on KEV status alone.

Frequently asked questions