What is the CVSS score of CVE-2026-40416?

CVE-2026-40416 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40416?

Yes, a patch is available for CVE-2026-40416. Update the affected software to the latest version immediately.

Microsoft Edge CVE-2026-40416

EUVD-2026-29673 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-05-12 microsoft

GHSA-p38p-qw9v-vf6v

Authentication Bypass Google Microsoft Microsoft Edge Chromium Based

4.3

CVSS 3.1 · NVD

Temporal: 3.8

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CIRCL (temporal)

3.8 LOW

cvss

vuln.today AI

4.3 MEDIUM

Network-delivered spoofing requiring active user click; no privileges needed; integrity-only impact with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:02 vuln.today

CVE Published

May 12, 2026 - 16:59 nvd

MEDIUM 4.3

DescriptionCVE.org

User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

AnalysisAI

Spoofing via UI misrepresentation in Microsoft Edge (Chromium-based) versions prior to 148.0.3967.55 allows a remote unauthenticated attacker to deceive users about critical browser information - such as origin indicators or security state - by delivering crafted web content over a network. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms exploitation requires user interaction and yields only limited integrity impact, consistent with a classic browser spoofing class. No public exploit code has been identified and CISA has not listed this in KEV; SSVC confirms zero observed exploitation and non-automatable delivery.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where a browser or UI framework fails to accurately render security-critical context - such as the origin domain in the address bar, SSL padlock state, or permission prompts - in a way that an attacker can manipulate to mislead users. The affected product is Microsoft Edge Chromium-based (CPE: cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*), which shares the Chromium rendering engine with Google Chrome. Because Edge inherits Chromium's compositing and navigation pipeline, misrepresentation bugs can arise at transitions between origins, during iframe rendering, or during full-screen state changes - common attack surfaces in this CWE class. The fix is confirmed in Edge 148.0.3967.55 per the EUVD advisory.

RemediationAI

Update Microsoft Edge (Chromium-based) to version 148.0.3967.55 or later, which contains the vendor-released patch per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40416. Edge typically auto-updates via its built-in update mechanism; administrators managing enterprise deployments should push the update via Microsoft Update, Windows Update for Business, or WSUS and verify the installed version through edge://settings/help. As a compensating control where immediate patching is not possible, organizations can enforce browser allowlists to restrict navigation to trusted domains via Edge's SmartScreen or enterprise URL filtering policies - this narrows the spoofing surface but does not eliminate it. User awareness training on verifying URL indicators independently of browser UI chrome provides additional, though imperfect, defense.