CVE-2016-3391

Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow context-dependent attackers to...

5.3 Medium

CVE-2016-3391 is a medium vulnerability (CVSS 5.3) in Microsoft Edge, published October 14, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.94%, the 94th percentile. No source names a fixed version.

Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow context-dependent attackers to discover credentials by leveraging access to a memory dump, aka "Microsoft Browser Information Disclosure Vulnerability."

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

7.94%Down 1.2 points since Feb 4, 2022

What each source reports

NVD Score used 5.3

Record: CVE-2016-3391
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 2.0: 2.6 LowAV:N/AC:H/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-3391
Updated: 2026-11-02

EUVDEUVD-2016-4417 No score

Record: EUVD-2016-4417
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qcrg-7gwp-23jq 5.3

Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow context-dependent attackers to...

Record: GHSA-qcrg-7gwp-23jq
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

Affected products

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD