What is the CVSS score of CVE-2026-45489?

CVE-2026-45489 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.5%.

Is there a patch available for CVE-2026-45489?

Yes, a patch is available for CVE-2026-45489. Update the affected software to the latest version immediately.

Microsoft Edge CVE-2026-45489

EUVD-2026-41598 MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2026-07-03 microsoft

GHSA-h8wv-x2gq-wqw9

Microsoft Google Microsoft Edge Chromium Based Authentication Bypass

6.5

CVSS 3.1 · NVD

Temporal: 5.7

Severity by source

Vendor (microsoft) PRIMARY

MEDIUM

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CIRCL (temporal)

5.7 MEDIUM

cvss

vuln.today AI

6.5 MEDIUM

Network-delivered spoofing requiring one user interaction, no privileges; high confidentiality impact from credential or data disclosure, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 22:11 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

MEDIUM 6.5

DescriptionNVD

Microsoft Edge (Chromium-based) Spoofing Vulnerability

AnalysisAI

Spoofing in Microsoft Edge (Chromium-based) prior to version 150.0.4078.48 allows a remote unauthenticated attacker to present deceptive browser UI to a victim user, resulting in high-confidentiality-impact information disclosure. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms exploitation is network-delivered and requires only a single user interaction, consistent with a classic UI-spoofing or URL-spoofing class of flaw. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available.

Technical ContextAI

Microsoft Edge (Chromium-based) is Microsoft's browser built on the open-source Chromium engine, which also underpins Google Chrome. The CPE (cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*) confirms the affected software is specifically the Chromium-derived Edge codebase, distinguishing it from the legacy EdgeHTML-based Edge. Tags reference both Google and Microsoft, suggesting the root cause may originate in the shared upstream Chromium rendering or navigation code rather than Microsoft-specific extensions. The vulnerability is classified as a Spoofing type, which in browser contexts typically manifests as address-bar spoofing, security indicator manipulation, cross-origin content injection into trusted UI chrome, or deceptive rendering of page content in a way that misleads the user about origin or identity. No CWE identifier was assigned by the reporter, so the precise weakness class (e.g., CWE-290 Authentication Bypass by Spoofing, CWE-451 UI Misrepresentation) cannot be confirmed from available data.

RemediationAI

Upgrade Microsoft Edge (Chromium-based) to version 150.0.4078.48 or later; this is the vendor-confirmed patched release per EUVD-2026-41598 and the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45489. Edge typically auto-updates via the built-in update mechanism; administrators managing enterprise deployments should verify the installed version via edge://settings/help or push the update through Microsoft Endpoint Manager or Group Policy. Where immediate patching is not feasible, compensating controls include enforcing Safe Links or URL-rewriting proxies (e.g., Microsoft Defender for Office 365) to intercept suspicious links before they reach the browser - note this adds latency and may break some legitimate deep links. Disabling JavaScript on untrusted origins via SmartScreen or browser security zone policies can reduce spoofing surface but will break broad site functionality. There are no workarounds that fully mitigate a browser-level spoofing flaw without patching.