Microsoft Edge CVE-2025-65046

Exploitation requires the victim to be running Microsoft Edge (Chromium-based) on Android and to navigate to attacker-controlled web content and interact with it (UI:R). No authentication is required (PR:N), but the high attack complexity (AC:H) implies the attacker must satisfy specific rendering/timing conditions to produce a convincing UI spoof. The impact is limited to UI misrepresentation/spoofing (I:L) with no confidentiality or availability impact - there is no data read or code execution - so realistic risk is confined to enabling phishing/social-engineering against mobile Edge users rather than direct compromise. The desktop/other-platform builds are not listed as affected by the CPE.

This is a genuinely low-priority issue, and all signals agree. The CVSS 3.1 base score is 3.1 (Low) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - network-reachable but high attack complexity, requires user interaction, and yields only a low integrity impact (UI misrepresentation) with no confidentiality or availability impact. This is consistent with CWE-451 (user interface misrepresentation of critical information), i.e. a spoofing bug rather than code execution or data theft. EPSS reinforces the low priority at 0.28% (18th percentile), there is no CISA KEV listing (not actively exploited), and no public proof-of-concept was identified. No SSVC data is supplied, but the technical impact is partial/low and exploitation is not automatable in any meaningful mass-exploitation sense given UI:R and AC:H. One data inconsistency to note: the input Tags label this 'Information Disclosure,' but the CVSS vector sets C:N (no confidentiality impact) and I:L - this is an integrity/spoofing issue, not information disclosure, so the tag is misleading. Net: real but minor; appropriate for routine patch cycles, not emergency remediation.

An attacker crafts a malicious web page that, when opened in Microsoft Edge (Chromium-based) on Android, manipulates browser UI (e.g. address-bar or security-indicator rendering) to misrepresent the true origin of content, supporting a convincing phishing or social-engineering lure. The victim must visit the page and interact with it, and the attacker must satisfy specific timing/rendering conditions (AC:H), so success is not reliable. No public exploit code was identified at time of analysis.