A race condition in Microsoft Edge (Chromium‑based) allows an authorized local attacker to read browser‑managed data that should not be exposed. The flaw is due to improper synchronization of a shared resource during concurrent execution, resulting in confidential information leakage but not enabling arbitrary code execution or privilege elevation.

Microsoft Edge (Chromium‑based) on any installation that includes the unsynchronized resource identified by the CNA. Because no specific version list is supplied, all builds that contain the race condition are considered vulnerable. Users should verify whether their Edge version is part of the affected release set described in the Microsoft advisory.

The CVSS score of 4.2 indicates medium impact, and the EPSS metric is not available, implying little evidence of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting it is not actively used by attackers yet. Exploitation requires local authorized access and the ability to trigger the race condition; it is therefore a local attack requiring the user to run Edge with sufficient privileges to influence the shared resource.