Microsoft Edge iOS CVE-2026-70331

User must be running Microsoft Edge on an iOS device with Copilot or AI-powered features active and accessible. The user must visit an attacker-controlled or compromised webpage and trigger an AI feature that processes the page content - such as Copilot summarization, AI-assisted search, or content analysis. The CVSS UI:R metric confirms passive exploitation is not possible; the user must take an action that causes Edge to process the malicious content through its LLM pipeline. The attacker requires no authentication or privileges against the target system (PR:N). Exploitation is limited to the iOS platform based on the primary CVE scope; desktop Chromium-based Edge may also be affected but this is not explicitly confirmed in the description. Non-AI Edge browsing workflows (standard page rendering without invoking AI features) do not trigger the vulnerable code path.

Real-world priority for this vulnerability is moderate. The CVSS 5.4 score is consistent with a spoofing-class flaw: network-accessible (AV:N), low complexity (AC:L), no attacker privileges required (PR:N), but requiring user interaction (UI:R) - meaning exploitation is not fully passive and requires a user to visit a malicious page and trigger an AI-powered Edge feature. Scope is unchanged (S:U), with limited confidentiality and integrity impacts (C:L/I:L) and no availability impact (A:N). No EPSS score was provided in the intelligence feed; without it, probabilistic exploitation rate cannot be quantified. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified. However, the 'Authentication Bypass' tag elevates concern: if prompt injection can circumvent AI-enforced guardrails, the real-world integrity impact may exceed what the base CVSS metrics reflect. The attack surface is constrained to users of Edge for iOS who actively use Copilot or AI summarization features - not every Edge user. This distinguishes it from a broad-surface network vulnerability. Priority should be elevated for organizations that deploy Edge on iOS for productivity workflows involving AI features.

An attacker hosts a webpage containing hidden text or metadata crafted as adversarial LLM prompts - for example, instructions embedded in white-on-white text or HTML comments that instruct Edge's Copilot to impersonate a trusted service, fabricate search results, or claim the user is authenticated. When a user on Edge for iOS visits this page and activates an AI feature (such as asking Copilot to summarize the page or answer a question about it), the injected prompts are processed alongside legitimate content, causing the AI to produce spoofed output aligned with the attacker's instructions. No public exploit code has been identified at time of analysis, but the attack concept is well-understood given the public nature of prompt injection as a technique.