The vulnerability is a time‑of‑check time‑of‑use race condition in Microsoft Edge (Chromium‑based). It allows an unauthorized attacker to read sensitive data that is otherwise protected. The flaw can lead to the disclosure of confidential information over a network, potentially compromising the privacy of users and the confidentiality of data managed by the browser.

Affected systems are all deployments of Microsoft Edge (Chromium‑based). No specific version range is provided; therefore every installed copy of that browser may be vulnerable until a patch is applied.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote over a network, as the description states an unauthorized attacker can disclose information over a network. Exploitation would require the attacker to trigger the race condition, which could involve sending specially crafted requests to the browser or manipulating its internal state.