EUVD-2026-29633
GHSA-r323-gp9m-h5c5
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-accessible spoofing requires no privileges and only passive user interaction; impact is limited to low confidentiality via UI deception with no integrity or availability effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Spoofing in Microsoft Edge for Android versions below 148.0.3967.55 allows a network-based attacker to misrepresent critical security UI elements - such as page origin indicators or certificate status - to users who interact with attacker-controlled content, classified under CWE-451 (User Interface Misrepresentation of Critical Information). Impact is limited to confidentiality (C:L) with no integrity or availability consequences per the CVSS vector, and exploitation requires user interaction (UI:R). With EPSS at 0.06% (18th percentile), SSVC exploitation status of none, and no CISA KEV listing, real-world exploitation risk is low despite the network-accessible, unauthenticated attack vector.
Technical ContextAI
CWE-451 describes failures where a UI does not accurately convey security-critical information to the user, enabling deception about the true origin, identity, or trustworthiness of content. In the context of Microsoft Edge for Android (CPE: cpe:2.3:a:microsoft:microsoft_edge_for_android), this likely manifests as a flaw in how the browser renders or displays address bar content, security indicators, or certificate details when processing crafted network content. Browser spoofing vulnerabilities in this class typically exploit inconsistencies between what the layout engine displays and what the actual loaded resource is, allowing a malicious page to impersonate a trusted origin. The 'Authentication Bypass' and 'Microsoft/Google' tags suggest the spoofing may be relevant to credential or identity contexts on the Android platform.
RemediationAI
Update Microsoft Edge for Android to version 148.0.3967.55 or later, available through the Google Play Store or enterprise mobile device management channels. The vendor patch is confirmed available per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35429. As a compensating control where immediate update is not possible, organizations can restrict browsing to managed in-app browsers or enforce MDM policies that prevent navigation to untrusted domains; however, this trades usability for risk reduction and does not address the underlying flaw. Additional context is available at https://vuldb.com/vuln/363262.
More in Microsoft Edge For Android
View allUse-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execu
External file path control in Microsoft Edge for Android (versions below 151.0.4129.59) allows a local low-privileged at
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop a
UI spoofing in Microsoft Edge for Android (versions below 148.0.3967.55) allows a remote, unauthenticated attacker with
Improper input validation in Edge for Android allows a remote attacker to tamper with data over a network by convincing
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today