Microsoft Edge For Android EUVD-2026-21603

The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates a network-accessible vulnerability with low attack complexity and no privilege requirements, but User Interaction is Required (UI:R). This moderately reduces real-world risk compared to a fully automated attack. The impact is limited to confidentiality and integrity (no availability impact), and the scope is unchanged. The exploitation likely depends on successful social engineering or user deception via the spoofed UI. While the moderate CVSS score (5.4) might suggest lower priority in some environments, the spoofing nature combined with network accessibility and low complexity means attackers can broadly target Edge users on Android if the UI flaw is obvious. No EPSS percentile, KEV status, or POC availability was provided in the input data; however, the fact that this is an Android-specific UI rendering flaw in a widely-used browser warrants timely patching. The authentication bypass tag suggests this may enable circumvention of security prompts or indicators, increasing practical risk for phishing and credential theft campaigns.

An attacker crafts a malicious web page or phishing email that exploits the UI misrepresentation flaw in Microsoft Edge for Android. When a user opens the link in Edge, the vulnerable browser renders a spoofed address bar, lock icon, or security indicator that falsely represents the website as a trusted domain (e.g., a bank or email provider). The user, deceived by the UI misrepresentation, enters credentials or approves a sensitive action, which the attacker captures or performs on behalf of the user. This attack requires user interaction but leverages the browser's own UI rendering vulnerability to bypass the user's normal security awareness.