CVE-2022-21931

Deeper analysis

Microsoft Edge (Chromium-based) is affected by CVE-2022-21931, a remote code execution vulnerability published in January 2022. The flaw carries a CVSS 3.1 score of 4.2 with the vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating a network-reachable issue that requires user interaction and presents high attack complexity along with limited impact on confidentiality and integrity.

An unauthenticated remote attacker can exploit the vulnerability by convincing a user to perform a specific action, such as visiting a crafted web page, after which limited code execution or data manipulation becomes possible within the browser context. No privileges are required on the target system, but the high complexity and required user interaction constrain the attack surface.

Microsoft has published official guidance and patches addressing the issue through its Security Response Center at the referenced URLs. The EPSS score remained low near disclosure but later rose materially from that baseline to a peak of 0.0625 in January 2025 before receding, indicating that exploitation interest emerged well after the initial announcement.