Microsoft Edge Android EUVD-2026-29715

The vulnerability requires the victim to be using Microsoft Edge for Android on a version below 148.0.3967.55 and to navigate to or be redirected to attacker-controlled web content over a network connection (AV:N). AC:H indicates a non-trivial setup requirement - likely a specific network position, precise crafting of the malicious page, or a race-condition-like timing element - rather than a simple, fire-and-forget exploit. Per SSVC, the attack is not automatable, reinforcing that reliable exploitation requires deliberate attacker setup per target. Exploitation is limited to the Android platform; desktop Edge users and iOS Edge users are not affected by this CPE. No authentication or special device privilege is required from the attacker side (PR:N), but the victim must actively use Edge for Android to browse to attacker-influenced content.

The CVSS base score of 6.5 reflects medium severity, with a network attack vector (AV:N), high complexity (AC:H), no privileges required (PR:N), and no user interaction (UI:N) per the published vector, with high confidentiality impact (C:H) and low integrity impact (I:L). However, a meaningful inconsistency exists in the CVSS vector: for a CWE-451 UI misrepresentation and spoofing vulnerability, UI:N (no user interaction) is atypical - spoofing attacks inherently require a victim to perceive and be deceived by the spoofed UI, which normatively maps to UI:R. This inconsistency should be verified against the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42891. Real-world risk signals are consistently low: EPSS at 0.05% places this in the 14th percentile, SSVC rates exploitation as none and automatable as no with only partial technical impact, and the vulnerability is absent from CISA KEV. AC:H further constrains opportunistic exploitation. The net assessment is a moderate-priority patch suitable for next scheduled mobile device management (MDM) update cycle rather than emergency response.

An attacker positioned to deliver a crafted link or intercept network traffic targeting Edge for Android users - for example via phishing email on a corporate mobile device - could serve a malicious page that causes Edge to misrepresent the apparent origin URL or security indicator, making the page appear to belong to a trusted domain such as a corporate SSO login or banking portal. The victim, trusting the spoofed browser UI, enters credentials that are then harvested by the attacker. No public proof-of-concept code has been identified, and AC:H suggests the attack requires specific conditions to trigger reliably.