Microsoft Edge for Android CVE-2026-35429

User interaction is required - the victim must actively navigate to or interact with attacker-controlled content in Microsoft Edge for Android (UI:R in the CVSS vector). No authentication or prior account access is required by the attacker (PR:N). Exploitation is limited to Microsoft Edge for Android installations running versions below 148.0.3967.55; other Edge variants are not listed as affected. The attack is not automatable per SSVC, meaning the attacker cannot trigger the vulnerability without user engagement. Exploitation is further constrained by the need to deliver a convincing pretext to induce the victim to follow a malicious link.

The CVSS base score of 4.3 (Medium) reflects a network-exploitable flaw with no privilege requirement (PR:N) and low complexity (AC:L), but the mandatory user interaction (UI:R) and limited scope (S:U, C:L only) substantially reduce severity. EPSS at 0.06% places this vulnerability in the 18th percentile - well below the threshold that typically warrants emergency response. SSVC corroborates this: exploitation status is 'none', the attack is not automatable (consistent with UI:R), and technical impact is only 'partial'. No CISA KEV listing and no public exploit code have been identified at time of analysis. Overall, this is a genuine but low-priority vulnerability - the CVSS score is a fair representation of theoretical risk, but EPSS and SSVC both signal negligible real-world exploitation activity. Mobile browser update cadence via app stores typically makes remediation straightforward.

An attacker crafts a malicious webpage that causes Microsoft Edge for Android's UI to misrepresent the page's origin or security status - for example, displaying a trusted domain name in the address bar while serving attacker-controlled content. A victim who follows a link to this page (via phishing email, SMS, or social media) may be deceived into entering credentials or trusting content they believe originates from a legitimate site. No public exploit code has been identified at time of analysis, making opportunistic mass exploitation unlikely.