Microsoft Edge Chromium Based CVE-2026-33118

The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) indicates a network-remotely exploitable spoofing flaw requiring user interaction but no authentication. The base score of 4.3 reflects low confidentiality impact and no integrity or availability compromise, classifying this as a low-severity finding. From an SSVC perspective, the requirement for user interaction (UI:R) raises the bar for automated exploitation; however, social engineering attacks that induce clicking or interaction are feasible. The information disclosure component (C:L) suggests attackers could trick users into believing fraudulent content is legitimate or obtain limited sensitive information through UI spoofing (e.g., phishing via fake address bar appearance). Patch availability further reduces active risk. This is a real but limited priority: the low base score and UI requirement mean widespread silent exploitation is unlikely, but targeted phishing or credential theft scenarios leveraging spoofing are plausible and merit timely patching.

An attacker crafts a malicious webpage that exploits the spoofing vulnerability to display a fake Microsoft Edge address bar or security indicator, convincing a user that they are visiting a legitimate banking or email site when they are in fact on the attacker's phishing domain. The victim enters credentials into the spoofed form, which are captured by the attacker. Alternatively, the attacker could spoof security warnings or permission dialogs to manipulate the user into enabling unwanted browser features or extensions. No public exploit code has been identified, but the low attack complexity and user-interaction requirement make manual proof-of-concept attacks straightforward for motivated threat actors.