CVE-2026-57991: Microsoft Edge Information Disclosure Flaw

CVE-2026-57991 Overview

CVE-2026-57991 is an information disclosure vulnerability in Microsoft Edge (Chromium-based) caused by improper link resolution before file access, commonly known as link following [CWE-59]. An unauthorized attacker can exploit this weakness over a network to disclose sensitive information from a victim's system. Exploitation requires user interaction, such as convincing the target to visit a crafted web page or open a malicious link. The vulnerability crosses a security boundary, allowing content from one context to access resources in another. Microsoft published the advisory on July 3, 2026, and the EPSS score stands at 0.745% with a percentile of 50.41 as of July 9, 2026.

Critical Impact
Successful exploitation lets a remote attacker read protected files or resources through link resolution abuse in Microsoft Edge, exposing confidential data across security scopes.

Affected Products

Microsoft Edge (Chromium-based) — all versions prior to the July 2026 security update
Windows deployments of Edge Chromium relying on default file resolution behavior
Enterprise browser installations where symbolic link handling has not been hardened

Discovery Timeline

2026-07-03 - CVE-2026-57991 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-57991

Vulnerability Analysis

The flaw resides in how Microsoft Edge (Chromium-based) resolves file links before accessing the underlying resource. The browser follows a link without adequately validating that the target of the link stays within the intended security boundary. An attacker who controls the link target can redirect file access to a location the browser process can read but the web content should not reach. The result is disclosure of file contents or metadata across origins or trust zones. The vulnerability is network-reachable and requires user interaction, aligning with a scope-changed information disclosure pattern.

Root Cause

The issue is classified under [CWE-59] Improper Link Resolution Before File Access. Edge resolves a filesystem link — such as a symbolic link, junction, or shortcut — and consumes the resolved path without re-checking permission boundaries. Because the check occurs before rather than after resolution, an attacker can substitute a link that points outside the sandboxed or expected directory. The browser then reads the target file with its own privileges and exposes the content to the attacker-controlled page.

Attack Vector

Exploitation is remote and requires the victim to interact with attacker-controlled content, for example by visiting a crafted page or downloading a manipulated archive that plants a link. Once triggered, Edge follows the link during a subsequent file access operation and returns data from an unintended location. The attacker does not need privileges on the target system. Scope change indicates the disclosure affects resources beyond the browser's own security context. No public proof-of-concept or in-the-wild exploitation has been reported as of publication.

No verified public exploit code is available. See the Microsoft Security Update CVE-2026-57991 advisory for vendor technical details.

Detection Methods for CVE-2026-57991

Indicators of Compromise

Unexpected file read operations by msedge.exe targeting paths outside the browser cache, profile, or download directories
Creation of symbolic links, junctions, or .lnk files inside Edge-writable directories immediately before browser file access events
Outbound HTTP/HTTPS transfers from Edge processes containing contents of local files not originated by the user
Anomalous parent-child process activity around Edge involving archive extraction utilities that produce link artifacts

Detection Strategies

Monitor process telemetry for msedge.exe opening files via resolved symbolic links or reparse points, then transmitting data over the network
Correlate file-system link creation events (CreateSymbolicLink, junction creation) with subsequent Edge read operations in the same directory
Inspect web traffic for exfiltration patterns where Edge uploads file-like payloads to non-standard endpoints shortly after page navigation

Monitoring Recommendations

Enable EDR file and process auditing on all endpoints running Microsoft Edge, focusing on link resolution and cross-directory reads
Log Edge version data across the fleet and alert on hosts running builds prior to the July 2026 security update
Track user navigation to newly registered or low-reputation domains that precede archive downloads and link creation events

How to Mitigate CVE-2026-57991

Immediate Actions Required

Deploy the Microsoft Edge security update referenced in the Microsoft Security Update CVE-2026-57991 advisory to all managed endpoints
Force-close and restart Edge on user systems to ensure the patched binary is loaded into memory
Verify Edge auto-update is enabled through group policy or Intune to prevent version drift
Restrict user permissions to create symbolic links on Windows where operationally feasible

Patch Information

Microsoft has released a security update for Microsoft Edge (Chromium-based) addressing CVE-2026-57991. Administrators should consult the Microsoft Security Update CVE-2026-57991 advisory for the fixed build number and deployment guidance. Update the browser through Microsoft Update, WSUS, Intune, or the Edge for Business enterprise channel.

Workarounds

Disable or restrict Edge's ability to open local file links from untrusted web contexts through group policy
Remove the SeCreateSymbolicLinkPrivilege from standard user accounts to limit link-based attack primitives
Instruct users to avoid extracting archives from untrusted sources into Edge-writable directories until patching is complete
Apply application control policies to block execution of legacy Edge builds that remain vulnerable

bash

# Enterprise policy example: enforce Edge auto-update via Windows registry
reg add "HKLM\SOFTWARE\Policies\Microsoft\EdgeUpdate" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\EdgeUpdate" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f