EUVD-2026-38085
GHSA-q6cc-35v5-92vm
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Browser XSS resulting in spoofing typically requires the victim to load attacker content (UI:R), no prior auth to the browser (PR:N), crosses the same-origin boundary (S:C), with limited C/I impact and no availability loss.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft Edge (Chromium-based) allows an authenticated remote attacker to perform spoofing attacks against users over a network. The flaw stems from improper neutralization of input during web page generation (CWE-79), and while CVSS rates impact as high across confidentiality, integrity, and availability, no public exploit identified at time of analysis.
Technical ContextAI
Microsoft Edge (Chromium-based) is Microsoft's web browser built on the open-source Chromium engine, which underlies Edge's HTML rendering, JavaScript execution, and DOM handling. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the classic cross-site scripting weakness, where untrusted input is reflected or stored and later rendered in a browser context without proper encoding or sanitization. In a browser-level XSS context, this typically involves the browser UI, internal pages (edge://), or extension/WebUI surfaces failing to encode attacker-controlled content, enabling script injection that can spoof trusted UI or pivot privileges within the renderer or browser process.
RemediationAI
Patch available per vendor advisory - update Microsoft Edge to the latest stable channel build as listed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32208, which for Edge is typically delivered automatically via the Edge Update service (MicrosoftEdgeUpdate.exe). Administrators managing Edge via Microsoft Intune, Group Policy, or WSUS should verify the update channel is enabled and force a sync; users can manually trigger an update via edge://settings/help. As a compensating control until patching, restrict navigation to untrusted sites via Edge's Enhanced Security Mode or site-list policies, and disable unnecessary Edge extensions that may broaden the attacker-controllable surface; trade-off is reduced functionality for users who rely on those extensions or browse a wide range of sites.
More in Edge Chromium
View allChrome's V8 JavaScript engine contains an out-of-bounds read and write vulnerability (CVE-2025-5419, CVSS 8.8) enabling
Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the r
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remo
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to
Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially
Heap buffer overflow in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit he
Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially expl
Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability. Rated high severity (CVSS 8.2), this vulnerability is r
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability
A security vulnerability in No cwe for this (CVSS 7.4) that allows an unauthorized attacker. Risk factors: public PoC av
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today