CVE-2026-57990 Overview
CVE-2026-57990 is an information disclosure vulnerability in Microsoft Edge (Chromium-based). Files or directories accessible to external parties allow an unauthorized attacker to disclose information over a network. The weakness is categorized under [CWE-552] (Files or Directories Accessible to External Parties). Exploitation requires user interaction, such as visiting a crafted web page, and can cross security boundaries because the scope is changed. Successful exploitation exposes confidential data without requiring privileges on the target system.
Critical Impact
An unauthorized remote attacker can trigger disclosure of sensitive files or directory contents from an affected Microsoft Edge browser session by convincing a user to interact with attacker-controlled content.
Affected Products
- Microsoft Edge (Chromium-based)
Discovery Timeline
- 2026-07-26 - CVE-2026-57990 published to the National Vulnerability Database
- 2026-07-27 - Last updated in the NVD database
Technical Details for CVE-2026-57990
Vulnerability Analysis
The vulnerability resides in how Microsoft Edge (Chromium-based) exposes files or directories to external parties. An unauthorized attacker can reach the vulnerable code path over the network by luring a user to attacker-controlled web content. Because the CWE mapping is [CWE-552], the issue involves resources that should remain isolated to the local user or origin becoming reachable to an outside party. The consequence is high-impact confidentiality loss, with no direct effect on integrity or availability of the target system. The EPSS probability for this CVE is 0.943%, indicating limited observed exploitation activity to date.
Root Cause
The root cause is improper restriction of access to files or directories that should be protected from external parties. Under [CWE-552], the browser or a related handler exposes resources to origins or callers that should not be permitted to read them. Combined with a scope change (S:C in the CVSS vector), the flaw allows a compromised or attacker-controlled context to reach data belonging to another security authority.
Attack Vector
The attack is network-based and requires user interaction. A user must navigate to a malicious page, open a crafted link, or interact with attacker-supplied content rendered by Microsoft Edge. No authentication or elevated privileges are required on the target. Once triggered, the flaw yields sensitive file or directory contents accessible to the attacker across a trust boundary.
No public proof-of-concept code is available. See the Microsoft Security Update Guide for vendor technical details.
Detection Methods for CVE-2026-57990
Indicators of Compromise
- Outbound HTTP or HTTPS requests from Microsoft Edge processes to unfamiliar domains immediately after a user opens an untrusted link.
- Unexpected read access to local files, browser profile directories, or user document paths originating from msedge.exe child processes.
- Browser telemetry showing renderer processes accessing resources outside their expected origin scope.
Detection Strategies
- Monitor Microsoft Edge process activity for anomalous file reads and outbound data transfers correlated with recently visited URLs.
- Deploy web content inspection to flag pages that attempt to reference local file schemes or unusual cross-origin resource loads.
- Correlate endpoint browser logs with proxy or DNS telemetry to identify sessions that touch known malicious infrastructure.
Monitoring Recommendations
- Ingest Microsoft Edge update status and version telemetry into your SIEM to identify unpatched endpoints.
- Track browser exploitation patterns aligned with [CWE-552] in threat intelligence feeds and prioritize alerts involving Edge renderer anomalies.
- Alert on user reports of unexpected file dialogs, downloads, or content prompts that may indicate social engineering paired with this flaw.
How to Mitigate CVE-2026-57990
Immediate Actions Required
- Update Microsoft Edge to the latest available Stable channel release that addresses CVE-2026-57990.
- Verify automatic browser updates are enabled and enforced through group policy across managed endpoints.
- Restrict browsing to untrusted sites for high-value users until patch deployment is confirmed.
Patch Information
Microsoft has published guidance for this vulnerability in the Microsoft Security Update Guide. Administrators should apply the referenced Edge Stable channel update on all Windows, macOS, and Linux endpoints running Microsoft Edge (Chromium-based). Confirm the installed version matches or exceeds the fixed build noted in the advisory.
Workarounds
- Enforce browser isolation or a remote browser solution for users who must access untrusted external content before patching completes.
- Configure Microsoft Edge policies to block navigation to file:// URLs and disable unnecessary features that expose local resources to web content.
- Educate users to avoid clicking links from unsolicited email, chat, or social media messages that lead to unknown domains.
# Configuration example: verify Microsoft Edge version on Windows endpoints
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" /v pv
# Configuration example: enforce Edge auto-update via Group Policy registry keys
reg add "HKLM\SOFTWARE\Policies\Microsoft\EdgeUpdate" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\EdgeUpdate" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
