Microsoft Edge Improper File/Directory Permissions Disclosure

CVE-2026-57990 represents a critical information disclosure vulnerability in Microsoft Edge (Chromium-based) where files or directories are accessible to unauthorized external parties over a network. This vulnerability, rated 7.4 (high) severity, stems from CWE-552 (Improper File and Directory Permissions), a foundational weakness where sensitive files lack appropriate access controls. The vulnerability affects organizations and individual users relying on Edge for browsing, potentially exposing sensitive configuration files, cached data, or user information to network-based attackers. While not yet observed in active exploitation campaigns tracked by CISA, the moderate-to-high CVSS score indicates meaningful real-world risk that organizations should address through timely patching and defensive monitoring.

Although CVE-2026-57990 does not map directly to MITRE ATT&CK techniques, Casky's AI-driven skill set enables practitioners to detect the reconnaissance and exploitation patterns that would precede or accompany this attack. Claude AI's extended reasoning capabilities can correlate unusual file access patterns, network-based enumeration attempts targeting Edge cache directories, and anomalous permission requests with potential exploitation activity. Practitioners using Casky would identify attack indicators such as T1005 (Data from Local System) when attackers attempt to exfiltrate accessible files, T1040 (Network Sniffing) if credential data is transmitted insecurely, and T1592 (Gather Victim Host Information) during reconnaissance phases. By mapping security findings against 754 mapped skills, organizations gain visibility into the attack chain—from initial discovery of misconfigured permissions through lateral movement and data exfiltration—enabling faster detection and response to exploitation attempts.