CVE-2026-70339

The EPSS score of 0.0024 for CVE-2026-70339 should not comfort you. A type confusion vulnerability in Chromium-based Edge that enables remote code execution but rates as CVSS 5.4 represents a calibration failure that masks genuine risk — and the gap between these two numbers tells you more than either does alone. The medium CVSS rating reflects a scoring system designed for discrete code-level flaws, not the emergent failures that arise from JavaScript JIT compilation, aggressive type inference, and complex optimization passes. No individual developer 'decided' to introduce this bug — it emerged from the gap between what the type system promises and what the runtime does under optimization pressure. That gap is irreducible at the authorship level, which means these aren't one-off mistakes that targeted patches will eliminate. They are a recurring genetic sequence in the browser engine that produces new variants regardless of how thoroughly each instantiation is fixed. The historical pattern is telling: type confusion vulnerabilities disclosed as medium-severity with low EPSS routinely flip to active weaponization within weeks of public proof-of-concept release. EPSS measures observed exploitation after disclosure — it is backward-looking by design. It tells you nothing about whether a researcher has already developed a working chain, whether the vulnerability existed for months before disclosure as an undisclosed zero-day, or whether adjacent bugs in the same JIT pathway will surface once this one receives attention. The 0.0024 is a weather reading, not a climate description. What should concern you more than the low EPSS is the blast radius. For hundreds of millions of users, Edge IS the operating system interface — email, documents, banking, VPN access, SSO sessions. A medium-rated type confusion that achieves RCE doesn't just compromise a workstation; it compromises everything the browser session trusts, including cached credentials, internal applications that rely on the origin model, and SSO tokens. The targeting risk — the difference between mass cannon and sniper round — is not captured by either metric. Threat actors with capable exploit development teams don't need public POCs. Verify whether this is patched in your current Edge Stable build and treat that verification as urgent rather than routine. More importantly, pressure-test your enterprise patch deployment timelines: every week an unpatched Edge persists in your fleet because a 5.4 doesn't trigger urgent response is a week of compounding exposure. The organizational normalization of medium-rated browser vulnerabilities is the actual debt accumulating — and it accrues interest faster than most risk committees assume.

Reviewed through automated stages and approved by a human before publication.