CVE-2026-58298: Cross-Site Scripting in Microsoft Edge Chromium—High-Severity XSS Vulnerability

Technical summary

CVE-2026-58298 is a CWE-79 input validation failure in Microsoft Edge (Chromium-based) where inadequate neutralization of user-supplied input during web page generation permits reflected or stored cross-site scripting attacks. The vulnerability requires no authentication or special network positioning (CVSS vector AV:N/AC:L/PR:N/UI:N). While it does not enable code execution on the host system, the high CVSS 3.1 score of 7.2 reflects the attack's broad network accessibility and the cross-site scope (S:C), combined with confidentiality and integrity impacts (C:L/I:L) that arise from session hijacking, credential theft, or content spoofing.

Business impact

Attackers leveraging this vulnerability can perform social engineering attacks at scale by injecting malicious scripts into web pages. Users of affected Edge versions risk credential compromise, unauthorized account access, and exposure to secondary malware delivery. Organizations with internal web applications that users access via Edge may face phishing campaigns that appear legitimate. The absence of active exploitation in the wild (KEV not listed) does not diminish the risk, as XSS vulnerabilities are routinely weaponized once patching lags.

Affected systems

Microsoft Edge (Chromium-based) is the affected product line. The vulnerability is likely present across multiple recent versions of Edge on Windows, macOS, and potentially Linux platforms. Determine your organization's specific Edge deployment versions and update status to identify at-risk systems.

Exploitability

The attack requires no user privileges and can be launched over a network. However, successful exploitation typically depends on social engineering—convincing a user to visit a malicious or compromised website, or exploiting stored XSS on a site the user trusts. The lack of user interaction (UI:N) in the CVSS vector suggests the attack can occur passively, such as via automatically loaded content or headers. The vulnerability is fundamentally exploitable once disclosed, though no known public exploit has been added to CISA's KEV catalog as of the publication date.

Remediation

Apply Microsoft's security updates for Edge as soon as they become available. Microsoft typically releases patches through automatic update mechanisms; ensure that automatic updates are enabled and allow systems time to restart if required. Verify patching completion by checking Edge's version number in Settings > About Microsoft Edge, which automatically checks for and applies updates.

Patch guidance

Consult Microsoft's official security advisories and the Edge release notes for the specific patched version number addressing CVE-2026-58298. Patches are typically rolled out through Windows Update and the Microsoft Edge auto-update service. Organizations using managed deployments should apply patches to test environments first, then to production according to your change management process. No single version number can be stated here without vendor confirmation; verify against the Microsoft security updates page.

Detection guidance

Monitor web server and proxy logs for anomalous script injection attempts or suspicious parameter values in GET/POST requests. Deploy endpoint detection and response (EDR) tools configured to flag unusual Edge process activity, such as unexpected network connections or file system modifications initiated from the browser. Implement Content Security Policy (CSP) headers on internal web applications to mitigate XSS impact even if the browser vulnerability is exploited. Watch for successful compromises through unusual credential usage, unauthorized access to sensitive areas, or detection of web shells on internal servers.

Why prioritize this

This vulnerability scores HIGH (7.2) due to its trivial network accessibility, absence of privilege or interaction requirements, and broad scope spanning cross-site contexts. While not listed on CISA's KEV catalog, the attack surface is enormous—every Edge user and every website they visit is a potential vector. XSS vulnerabilities are among the most frequently exploited web security flaws, and Chromium-based browsers represent a significant portion of web traffic. Organizations should prioritize patching to minimize the window of exposure before widespread tooling becomes available.

Risk score, explained

CVSS 3.1 score 7.2 (HIGH) is driven by Network accessibility (AV:N), Low attack complexity (AC:L), no privilege requirement (PR:N), and no user interaction needed (UI:N). The Changed Scope (S:C) elevates risk because the vulnerability can impact resources beyond the vulnerable component—an attacker can compromise sessions or inject content affecting other web applications or user data. Confidentiality and Integrity impacts (C:L, I:L) reflect the realistic threats of information disclosure and data manipulation, though Availability is not impacted (A:N).

Frequently asked questions