Microsoft Edge CVE-2026-45488

Exploitation requires a victim using Microsoft Edge (Chromium-based) below version 150.0.4078.48 to actively navigate to or load content from an attacker-controlled web resource (UI:R in the CVSS vector). The attacker requires no authentication or privileges on the target system (PR:N). No special non-default browser configuration is indicated as required - the flaw appears to be triggerable in standard Edge deployments. Exploitation is limited by the mandatory user interaction: the victim must open a malicious link or page, preventing fully automated, opportunistic attacks. The 'Authentication Bypass' tag suggests exploitation may be further dependent on a user encountering an authentication flow (e.g., a login dialog) while the misrepresentation is active, though this condition is inferred rather than explicitly confirmed by the description.

The CVSS 3.1 base score of 5.4 (Medium) reflects a network-accessible, low-complexity attack requiring no privileges but mandating user interaction (UI:R), with limited confidentiality and integrity impact and no availability impact. The UI:R requirement is a meaningful real-world constraint - exploitation depends on a victim actively browsing to or loading attacker-controlled content, limiting opportunistic mass exploitation. No EPSS score was provided in the intelligence feed, so statistical exploitation probability cannot be cited. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, further reducing near-term risk. However, the 'Authentication Bypass' tag introduces uncertainty: if the misrepresentation can be used to spoof authentication UI, the practical impact (credential theft, account takeover) may exceed what the C:L/I:L CVSS metrics suggest. The CVSS scope is unchanged (S:U), indicating the impact is contained to the browser context. Overall, this is a genuine but moderate-priority finding - important to patch promptly given Edge's wide deployment footprint, but not an emergency absent active exploitation evidence.

An attacker hosts a malicious or compromised webpage that triggers the UI misrepresentation flaw, causing Edge to display falsified security indicators - such as a spoofed origin, fabricated padlock status, or a fake authentication prompt - while the user believes they are on a legitimate site. The victim, misled by the browser's UI, submits credentials or grants permissions to the attacker-controlled page. No public proof-of-concept has been identified, so exploitation currently requires independent discovery of the precise trigger condition.