CVE-2026-57990: Microsoft Edge Exposes Local Files and Directories to Remote Attackers

Summary

Microsoft has disclosed CVE-2026-57990, a high-severity vulnerability in Microsoft Edge (Chromium-based) classified as an access control failure (CWE-552). The flaw allows an unauthenticated remote attacker to access files or directories on a victim's system or network that should not be reachable from external web content.

Technical Details

CVE-2026-57990 is an access control failure in Microsoft Edge's handling of file path resolution, local content serving, or resource fetching. The vulnerability falls under CWE-552, covering scenarios where an application or browser exposes local filesystem resources or internal network content to external parties that should have no access.

Unlike memory corruption bugs, this is a logic-level flaw — Edge's security controls fail to block a remote web page from reaching resources it should never be able to access. This class of vulnerability can expose:

• Browser profile data: Saved passwords, authentication cookies, session tokens stored in Edge's profile directory
• Local files: Files accessible to the browser's process on the victim's filesystem
• Internal enterprise resources: Intranet content, internal services, or cached enterprise application data
• Edge-specific data: Configuration, extension data, or cached credentials for Microsoft account integration

Attack scenario: A victim visits an attacker-controlled web page. The page exploits the file/directory exposure flaw to read protected resources — local files, profile data, or internal network content — and exfiltrates them to the attacker's server. No special permissions or prior access is required from the attacker's side.

As with CVE-2026-57989 (also disclosed July 26, 2026), this CVE was assigned by Microsoft rather than the upstream Chromium project, pointing to an Edge-specific implementation issue in its unique features or integrations.

Affected Products

• Microsoft Edge (Chromium-based) — all stable, beta, and extended stable channel versions prior to the patched build
• Platforms: Windows, macOS, Linux (all platforms Edge is distributed on)
• Legacy Microsoft Edge (EdgeHTML-based) is not affected (discontinued)

Patch and Remediation

Microsoft shipped a fix as part of the late-July 2026 Edge out-of-band security update cycle (published 2026-07-26).

Update Microsoft Edge immediately:

1. Navigate to edge://settings/help in Edge
2. Edge will automatically check for and download the latest update
3. Restart the browser when prompted
4. Confirm the version shown is 150.0.4078.99 or later

Enterprise patch deployment:

• Microsoft Intune: Use Edge app policies to enforce updates across managed devices
• Group Policy / ADMX: Deploy EdgeUpdate policies via Active Directory
• WSUS / Microsoft Update: Ensure Microsoft Edge is included in your approved updates

Risk Context

At CVSS 7.4 (HIGH), the key risk factors are similar to CVE-2026-57989 but with a distinct threat model:

• No authentication required by the attacker — exploitation requires only a victim browsing to a crafted page
• File-level access risk — in enterprise environments, browser profiles may contain cached credentials, certificates, or authentication tokens for internal systems
• User interaction required — phishing remains the most practical delivery mechanism

Organizations running Edge in enterprise environments where it is used to access internal applications, intranets, or SSO-protected resources face elevated risk from this class of vulnerability.

This advisory is part of the same late-July 2026 Edge patch cycle that also addressed CVE-2026-57989 (origin validation error) and multiple Critical-rated RCE vulnerabilities. The full batch should be treated as a high-priority patching event.

Recommended Actions

1. Update Edge immediately on all managed devices — version 150.0.4078.99 or later
2. Prioritize endpoints where Edge is used to access sensitive internal systems or SSO-protected applications
3. Audit Edge profiles: Review whether sensitive credentials or session data are cached in browser profiles on high-value endpoints
4. Consider profile isolation: For privileged workstations, use separate Edge profiles or dedicated browsers for administrative tasks
5. Patch alongside CVE-2026-57989: Both vulnerabilities share the same patch cycle — address them together

References

• Microsoft Security Response Center — CVE-2026-57990
• NVD — CVE-2026-57990
• Microsoft Edge Release Notes for Security Updates
• Canadian Centre for Cyber Security — Microsoft Edge Security Advisory AV26-714
• CWE-552: Files or Directories Accessible to External Parties — MITRE
• CVE-2026-57989 — Related Microsoft Edge Advisory