This vulnerability, identified as CWE-59, occurs due to improper link resolution before file access in Microsoft Edge (Chromium-based). It enables an unauthorized attacker to disclose sensitive information over a network by exploiting how the browser resolves symbolic links or shortcuts before accessing files. The CVSS 3.1 score is 7.4 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality impact. Microsoft has published an official fix to address this issue.

Successful exploitation can lead to unauthorized disclosure of sensitive information over a network without requiring privileges but does require user interaction. The integrity and availability of the system are not impacted. The vulnerability affects confidentiality with a high impact rating.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as detailed in their advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57991 to remediate this vulnerability.