EUVD-2026-29715
GHSA-hg2q-w8gq-jmf7
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Changed UI:N to UI:R because CWE-451 spoofing inherently requires a victim to view and be deceived by the misrepresented UI element; all other metrics align with the published vector.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
UI spoofing in Microsoft Edge for Android (versions below 148.0.3967.55) allows a remote, unauthenticated attacker with high attack complexity to misrepresent critical browser security information to victims over a network, potentially deceiving users about the true origin or security state of web content. The flaw stems from CWE-451, where the browser fails to correctly display security-critical UI elements such as address bar content or trust indicators, enabling phishing or credential theft scenarios. No public exploit code has been identified, EPSS probability sits at 0.05%, and CISA SSVC rates exploitation status as none - placing this as a moderate-priority patch rather than an urgent emergency.
Technical ContextAI
The affected product is Microsoft Edge for Android (CPE: cpe:2.3:a:microsoft:microsoft_edge_for_android:*:*:*:*:*:*:*:*), a Chromium-based mobile browser. The root cause is CWE-451 (User Interface Misrepresentation of Critical Information), which describes vulnerabilities where a software component fails to accurately display security-relevant information - such as the origin URL, SSL certificate status, or site identity indicators - to users in a way that can be relied upon. In mobile browsers, this class of flaw is particularly dangerous because reduced screen real estate already limits what security chrome (UI chrome, not the browser) is visible. An attacker-controlled page or network position can cause the browser to render misleading security signals, making a malicious or adversary-in-the-middle context appear legitimate. The Chromium foundation of Edge means patches may partially align with upstream Chromium security releases, but the Android-specific UI layer and vendor customizations can introduce independent vulnerabilities.
RemediationAI
The vendor-released patch is Microsoft Edge for Android version 148.0.3967.55 or later, available through standard app store update channels (Google Play Store) and enterprise MDM distribution. Organizations managing Android devices via Intune, JAMF, or other MDM solutions should push the update to version 148.0.3967.55 as part of their next scheduled patch cycle. Consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42891 for release notes and deployment guidance. As a compensating control while patching is pending, administrators can restrict the use of Microsoft Edge for Android for high-risk browsing scenarios (such as accessing internal SSO portals or sensitive financial sites) and redirect users to an alternative browser with a verified patch status. User awareness training to verify URLs manually before entering credentials provides some residual risk reduction but is not a reliable technical control given the nature of UI spoofing.
More in Microsoft Edge For Android
View allUse-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execu
External file path control in Microsoft Edge for Android (versions below 151.0.4129.59) allows a local low-privileged at
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop a
Improper input validation in Edge for Android allows a remote attacker to tamper with data over a network by convincing
Spoofing in Microsoft Edge for Android versions below 148.0.3967.55 allows a network-based attacker to misrepresent crit
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today