This vulnerability, identified as CWE-59, involves improper link resolution before file access in Microsoft Edge (Chromium-based). It can be exploited by an unauthorized attacker to disclose sensitive information over a network. The CVSS v3.1 base score is 7.4, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and a scope change. The confidentiality impact is high, with no impact on integrity or availability. Microsoft has published an official fix for this vulnerability.

An attacker can leverage this vulnerability to disclose sensitive information remotely without requiring privileges, potentially leading to significant confidentiality breaches. There is no impact on integrity or availability. The vulnerability requires user interaction and results in a scope change, increasing the potential impact.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the available patch promptly by following the guidance in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57991. No additional mitigation steps are indicated by the vendor.