This vulnerability, identified as CWE-918, involves server-side request forgery in Microsoft Edge (Chromium-based). An attacker can exploit this flaw to cause the browser to make unauthorized requests over the network, potentially bypassing security controls. The CVSS v3.1 base score is 7.4, indicating high severity, with network attack vector, low attack complexity, no privileges required, but user interaction needed, and a scope change. Confidentiality impact is high, while integrity and availability impacts are none. Microsoft has published an official fix for this vulnerability.

Successful exploitation of this SSRF vulnerability could allow an attacker to spoof network requests, potentially accessing sensitive internal resources or services that are otherwise inaccessible. The confidentiality of data could be compromised, but integrity and availability are not impacted according to the CVSS vector. No known exploits are currently reported in the wild.

An official fix is available from Microsoft. Users and administrators should apply the update provided in the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57993 to remediate this vulnerability.