Microsoft Edge CVE-2026-57990 Allows External File Access

Microsoft has disclosed a high-severity vulnerability in its Chromium-based Edge browser that can expose files or directories to unauthorized parties.

A high-severity information disclosure flaw affects Microsoft Edge. The vulnerability, tracked as CVE-2026-57990, carries a CVSS base score of 7.4. It allows an unauthorized attacker to disclose information over a network.

The flaw stems from files or directories being accessible to external parties. Microsoft assigned the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. The issue was published to the CVE List on July 26, 2026.

The vulnerability impacts all versions of the affected browser. Affected products are listed as Microsoft Edge (Chromium-based) with version status marked as affected. The weakness is classified under CWE-552, Files or Directories Accessible to External Parties.

The National Vulnerability Database record was received from Microsoft Corporation. No CVSS 4.0 or CVSS 2.0 assessment has been provided by NVD yet. The record was added to the NVD dataset on the same day it was published.

Microsoft has published an advisory with further details. Guidance is available at the Microsoft Security Response Center update page for this CVE. The record notes one change history entry dated July 26, 2026 at 2:18:25 PM that added the description, CVSS vector, CWE entry, reference, and affected product information.

Organizations using Microsoft Edge should consult the official advisory for remediation steps. The vulnerability requires user interaction according to the vector but can be triggered over a network with low attack complexity.