CVE-2026-57987: Server-Side Request Forgery in Microsoft Edge (Chromium) – Medium Severity

Technical summary

The vulnerability is classified as CWE-918 (Server-Side Request Forgery) in Microsoft Edge's Chromium engine. The attack vector is network-based with low attack complexity, requires no special privileges, but does require user interaction (UI:R). The impact scope is unchanged (the vulnerability does not cross trust boundaries), confidentiality is high (an attacker may read sensitive data accessible from the browser context), while integrity and availability remain unaffected. The CVSS v3.1 score of 6.5 (Medium) reflects a configuration where user interaction is a necessary precondition but the confidentiality impact is substantial. An attacker exploits this by controlling content served over the network—typically a website or embedded resource—that causes Edge to make requests to unintended targets, such as internal IP addresses, localhost services, or cloud metadata endpoints.

Business impact

The primary business risk is information disclosure. If users visit a malicious or compromised website while using the affected Edge version, an attacker could extract sensitive data from internal systems, cloud metadata services, or authentication tokens accessible from the user's network context. This is particularly concerning in corporate environments where internal services (databases, admin panels, cloud metadata) may be accessible from employee workstations. For organizations relying on Edge as a standard browser, this could facilitate reconnaissance prior to lateral movement attacks or credential harvesting. The requirement for user interaction limits the risk scope to users who can be socially engineered or who visit compromised sites, but does not eliminate the threat.

Affected systems

Microsoft Edge (Chromium-based) versions prior to the patch are affected. The vulnerability is specific to the Chromium-based Edge implementation, not legacy Edge. Affected users include anyone running an unpatched version of Chromium-based Edge. Organizations should verify the exact affected version range against Microsoft's security advisory and their current deployment baseline.

Exploitability

Exploitation requires user interaction—the attacker cannot force a request without the user visiting a malicious page or clicking a link. Once a user arrives at the attacker-controlled content, the browser automatically performs the SSRF request without further prompting. The attack complexity is low, meaning the attacker needs only a straightforward website or advertisement served over the network. This is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no public evidence of active, widespread exploitation at time of publication. However, the simplicity of exploitation and the high confidentiality impact mean this could become attractive to threat actors if weaponized proof-of-concept code emerges.

Remediation

Apply the security update provided by Microsoft for Chromium-based Edge. Organizations should verify the patched version number from the official Microsoft security advisory and deploy it through their standard browser update mechanisms (managed updates, WSUS, Intune, or manual updates depending on your environment). For managed deployments, expedite testing and rollout to affected user populations within 30 days, prioritizing users who access sensitive internal services or handle confidential data.

Patch guidance

Obtain the latest patched version of Microsoft Edge (Chromium-based) from Microsoft's official security advisory page. Verify the specific version numbers that address CVE-2026-57987 before deployment. For enterprise users, configure automatic updates or use Microsoft Intune/Group Policy to enforce the patch across your organization. Test in a pilot group before broad deployment to ensure compatibility with internal web applications and extensions. For consumer users, enable automatic updates in Edge settings (Settings > About Microsoft Edge) to receive patches automatically.

Detection guidance

Monitor for unusual outbound requests from Edge processes to internal IP ranges (RFC 1918), localhost (127.0.0.1), or cloud metadata endpoints (169.254.169.254 on AWS environments). Implement web proxy or firewall rules that log and restrict Edge's access to internal services from user workstations. Email gateway logs may reveal phishing or malicious links that could be used to deliver SSRF payloads. Endpoint detection tools should alert on Edge processes making requests to unexpected internal targets, though false positives may occur for legitimate internal web resources. Vulnerability scanning should confirm remediation by verifying Edge version numbers post-patch.

Why prioritize this

This vulnerability merits prompt attention in most environments due to the combination of network accessibility, user interaction as a reasonable attack precondition, and high confidentiality impact. Prioritize patching for: (1) users in security-sensitive roles with access to internal systems; (2) organizations with sensitive internal services accessible from user networks; (3) businesses where social engineering or phishing is a known threat. The Medium severity rating and lack of active exploitation in the wild allow for a structured, tested rollout rather than emergency patching, but should not be deferred more than 30 days in high-risk environments.

Risk score, explained

The CVSS v3.1 score of 6.5 (Medium) is driven by: high confidentiality impact (C:H)—an attacker can read sensitive data from the user's network context; low attack complexity (AC:L)—the exploit requires only a network request and a user-controlled webpage; no privilege requirement (PR:N); and user interaction dependency (UI:R)—the user must visit the attacker's content. The score does not reflect integrity or availability impact because SSRF here is used for information disclosure, not data modification or service disruption. The presence of the UI requirement prevents a higher score, but the information disclosure risk remains significant in networked corporate environments.

Frequently asked questions