CVE-2016-3291

Microsoft Internet Explorer 11 and Microsoft Edge mishandle cross-origin requests, which allows...

2.4 Low

CVE-2016-3291 is a low vulnerability (CVSS 2.4) in Microsoft Edge, published September 14, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 13.0%, the 96th percentile. No source names a fixed version.

Microsoft Internet Explorer 11 and Microsoft Edge mishandle cross-origin requests, which allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

13.0%Down 1.6 points since Feb 4, 2022

What each source reports

NVD Score used 2.4

Record: CVE-2016-3291
CVSS 3.0: 2.4 LowCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
CVSS 2.0: 2.6 LowAV:N/AC:H/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-3291
Updated: 2026-11-02

EUVDEUVD-2016-4324 No score

Record: EUVD-2016-4324
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8gcx-r2jx-rgg2 2.4

Microsoft Internet Explorer 11 and Microsoft Edge mishandle cross-origin requests, which allows...

Record: GHSA-8gcx-r2jx-rgg2
CVSS 3.0: 2.4 LowCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

Affected products

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD