CVE-2026-58616
Full vulnerability record from the local CVENow database.
Description
Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to disclose information over a network.
Severity
LOW
CVSS score
3.0
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-08-28 20:18:44.927000
Last modified
2026-10-28 21:16:58.457000
View original CVE JSON
{
"id": "CVE-2026-58616",
"sourceIdentifier": "[email protected]",
"published": "2026-08-28T20:18:44.927",
"lastModified": "2026-10-28T21:16:58.457",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to disclose information over a network."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Microsoft Edge (Chromium-based)",
"versions": [
{
"version": "1.0.0.0",
"lessThan": "152.0.4191.53",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Edge for Android",
"versions": [
{
"version": "1.0.0.0",
"lessThan": "152.0.4191.52",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Edge for iOS",
"versions": [
{
"version": "1.0.0.0",
"lessThan": "152.0.4191.52",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Edge for Linux",
"versions": [
{
"version": "1.0.0",
"lessThan": "152.0.4191.52",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Edge for MAC",
"versions": [
{
"version": "1.0.0.0",
"lessThan": "152.0.4191.52",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Edge for Windows",
"versions": [
{
"version": "1.0.0.0",
"lessThan": "152.0.4191.52",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.3,
"impactScore": 2.7
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N",
"baseScore": 3.0,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.3,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-28T20:15:16.258744Z",
"id": "CVE-2026-58616",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-362"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:-:*:*:*",
"versionEndExcluding": "152.0.4191.53",
"matchCriteriaId": "3F91281C-0214-4002-992E-2EEF8E72193E"
}
]
}
]
}
],
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58616",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}