CVE-2026-58616: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Microsoft Microsoft Edge (Chromium-based)

This vulnerability (CVE-2026-58616) involves a race condition (CWE-362) in the Copilot Chat component of Microsoft Edge (Chromium-based). Improper synchronization when concurrently accessing shared resources can lead to information disclosure over a network by an authorized attacker. The issue affects Microsoft Edge versions from 1.0.0 up to but not including 152.0.4191.52. Microsoft has published an official fix to address this vulnerability.

An authorized attacker could exploit this race condition to disclose sensitive information over a network. The vulnerability does not allow for denial of service or integrity violations but can lead to confidentiality loss. The CVSS v3.1 base score is 4.4 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, and user interaction needed.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the update to Microsoft Edge version 152.0.4191.52 or later to remediate the issue. No additional mitigation actions are required beyond applying the official patch.