CVE-2015-6058: Microsoft Edge XSS filter bypass via mishandled HTML attributes

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityThe flaw only bypasses a client-side defense-in-depth filter with partial integrity impact, but the high EPSS score and broad Edge exposure warrant timely patching.

What it is

Microsoft Edge mishandles HTML attributes in HTTP responses, allowing a remote attacker to bypass the browser's cross-site scripting (XSS) protection mechanism. Because the built-in filter fails to neutralize crafted markup, script injected into a response can execute in the victim's browser despite the protection being present. This matters because the XSS filter is a defense-in-depth control that users and sites implicitly rely on.

Impact

An attacker can execute script in the context of a vulnerable site in the victim's Edge browser, enabling session theft, credential harvesting, or actions performed as the victim. The CVSS 2.0 vector shows partial integrity impact only, with no confidentiality or availability impact recorded.

Attack surface

Reached remotely over the network by delivering a crafted HTTP response containing malformed HTML attributes to a victim browsing with Microsoft Edge. No authentication is required, but the CVSS vector indicates medium attack complexity and the description implies some user interaction (visiting the malicious or compromised page).

Exploitation

Not listed in CISA KEV and no reference is tagged as exploit code, so there is no confirmed in-the-wild exploitation in this record. EPSS is high (0.69997, 99.3rd percentile), indicating elevated predicted likelihood of exploitation activity.

What to do

• Apply Microsoft security bulletin MS15-107 to update affected Edge installations.
• Keep Edge and the underlying Windows platform on current cumulative updates, since this is a 2015 issue superseded by later servicing.
• Do not rely on the browser XSS filter as a primary control; enforce server-side output encoding and a Content-Security-Policy on web applications.
• Where Edge cannot be updated, restrict browsing to trusted sites and consider an alternative supported browser.

Detection

• Monitor web proxy and IDS logs for HTTP responses containing malformed or unusual HTML attribute patterns targeting Edge user agents.
• Review browser and endpoint telemetry for unexpected script execution or anomalous outbound requests originating from Edge sessions.
• Hunt for known XSS payload patterns in request/response bodies where the response is served to Edge clients.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.