EUVD-2026-41574
GHSA-3xgf-55j3-v68w
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N
Network-delivered spoofing requires victim to load attacker content (UI:R, PR:N); partial confidentiality and integrity loss from deception; no availability or scope change.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
UI misrepresentation in Microsoft Edge (Chromium-based) prior to version 150.0.4078.48 enables network-based spoofing attacks against users who interact with attacker-controlled web content. The browser fails to accurately present critical security information - such as origin indicators, security status, or authentication prompts - allowing an unauthenticated remote attacker to deceive victims into believing they are interacting with a trusted source. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and a vendor patch is available.
Technical ContextAI
CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where security-critical UI elements - such as address bar content, SSL/TLS padlock indicators, permission dialogs, or site identity signals - can be manipulated or obscured by attacker-controlled content. In Chromium-based browsers, this class of vulnerability often involves the renderer process influencing chrome-level UI in ways the browser's security model is designed to prevent. The inclusion of an 'Authentication Bypass' tag suggests the misrepresentation may specifically affect authentication-related UI (e.g., login prompts, credential dialogs, or origin headers), enabling phishing or session confusion attacks. The affected CPE is cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*, covering all Chromium-based Edge versions below 150.0.4078.48.
RemediationAI
The primary fix is to update Microsoft Edge (Chromium-based) to version 150.0.4078.48 or later, as confirmed by the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45488. Edge typically updates automatically via its built-in update mechanism, but administrators in managed environments should verify deployment via Microsoft Intune, WSUS, or equivalent update management tooling. As a compensating control where immediate patching is not possible, organizations can enforce browsing restrictions to known-trusted domains via DNS filtering or web proxy allowlists, reducing exposure to attacker-controlled pages that would deliver this spoofing attack - though this approach significantly degrades general browsing functionality. User awareness training on verifying site identity through alternative means (e.g., certificate details) is a low-friction supplement but is not a substitute for patching.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today