Microsoft Edge CVE-2026-88078

Exploitation requires an Edge user to interact with attacker-supplied content (UI:R) - for example visiting or engaging with a malicious page - allowing the attacker to exploit improper cryptographic-signature verification to spoof trusted content over the network without authentication (PR:N). Limiting factors: the required user interaction, the confined impact (integrity-only spoofing, no code execution or data disclosure), and the availability of a vendor patch; affected builds are Microsoft Edge (Chromium-based) 1.0.0.0 through versions below 156.0.4314.42, so updating to 156.0.4314.42 or later removes exposure. The description does not specify any particular feature or non-default configuration as a precondition.

This is a moderate-severity spoofing issue (CVSS 4.3) whose real-world priority is limited despite the network attack vector. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) shows an unauthenticated network-reachable flaw, but impact is confined to a low integrity hit (spoofing) with no confidentiality or availability loss, and exploitation requires user interaction (UI:R). The temporal metrics reinforce a low urgency posture: E:U (exploit unproven), RL:O (official fix available), and RC:C (confirmed). No CISA KEV listing and no POC are present in the input, and no EPSS score was provided, so exploitation probability cannot be quantified from the data. The vuln.today decision label is 'this_month' - meaningfully below act_now/emergency - which is consistent with the low-impact, no-known-exploit signal set. The one amplifying factor is prevalence: Microsoft Edge is extremely widely deployed, so even a low-impact flaw has a large exposed population. Net assessment: a legitimate issue to patch on a routine monthly cadence, not an emergency; the signals are internally consistent rather than conflicting, with the main data gap being the absence of EPSS.

An attacker lures a victim Edge user to attacker-controlled web content; because Edge improperly verifies a cryptographic signature (CWE-347), the attacker presents content that appears to carry a valid/trusted signature, spoofing trusted identity or UI to the user. No public exploit was identified at time of analysis (CVSS E:U), and success depends on user interaction (UI:R), typically visiting or interacting with the malicious content.