CVE-2026-58616: Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft E
mediumvulnerabilityLLM-Specific
security
Summary
A race condition (a bug where two processes access the same resource at the same time, causing unpredictable behavior) exists in Microsoft Edge's Copilot Chat feature that allows an authorized attacker to leak sensitive information over a network.
Vulnerability Details
CVSS Score
4.4(medium)
EPSS (30-day exploit probability)
EPSS: 0.0%
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector
network
Attack Complexity
high
Privileges Required
low
User Interaction
required
Disclosure Date
August 28, 2026
Classification
Attack Type
Other
Attack SophisticationModerate
Impact (CIA+S)
confidentiality
AI Component TargetedAPI
Affected Vendors
Microsoft
Related Issues
Monthly digest — independent AI security research
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-58616
First tracked: August 28, 2026 at 08:08 PM
Classified by LLM (prompt v3) · confidence: 85%