What is the CVSS score of EUVD-2026-41569?

EUVD-2026-41569 has a CVSS 3.1 base score of 6.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Edge are affected by EUVD-2026-41569?

Microsoft Edge spoofing vulnerability allows unauthenticated attackers to impersonate trusted content and UI, creating significant phishing and credential-theft risk for all Edge users across your…. A patch is available.

How to fix or mitigate EUVD-2026-41569?

Within 24 hours: Inventory all Microsoft Edge deployments across endpoints and communicate the mandatory security update requirement to IT teams and users. Within 7 days: Download and test the latest patched version of Microsoft Edge in an isolated test environment to validate compatibility. Within 30 days: Deploy the patched Edge version organization-wide via WSUS, Intune, or your endpoint management platform, targeting 100% of Edge installations.

Microsoft Edge EUVD-2026-41569

| CVE-2026-58282 MEDIUM

Improper Access Control (CWE-284)

2026-07-03 microsoft

GHSA-vfww-fwcc-xcp7

Authentication Bypass Microsoft Google Microsoft Edge Chromium Based

6.9

CVSS 3.1 · NVD

Temporal: 7.1

Severity by source

Vendor (microsoft) PRIMARY

HIGH

qualitative

NVD

6.9 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N

CIRCL (temporal)

7.1 HIGH

cvss

vuln.today AI

6.1 MEDIUM

Network spoofing needs victim to view attacker content (UI:R) under difficult conditions (AC:H); impact is integrity/trust (I:H) with a cross-origin scope change, no real confidentiality or availability loss.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Severity Changed

Jul 06, 2026 - 19:22 NVD

HIGH MEDIUM

CVSS changed

Jul 06, 2026 - 19:22 NVD

8.1 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Jul 03, 2026 - 21:17 vuln.today

CVE Published

Jul 03, 2026 - 20:35 cve.org

HIGH 8.1

DescriptionNVD

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

AnalysisAI

Spoofing in Microsoft Edge (Chromium-based) lets a remote, unauthenticated attacker bypass an origin/security-context access control (CWE-284) to misrepresent trusted content or UI over a network. The flaw carries CVSS 8.1 with a scope-changed vector and high integrity impact, meaning a successful spoof can influence resources beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has shipped an official fix.

Technical ContextAI

Microsoft Edge (Chromium-based) shares the Blink/Chromium engine, so access-control and origin-isolation logic (same-origin policy, site isolation, security-context indicators) is the likely locus of the defect. CWE-284 (Improper Access Control) indicates that a security decision - plausibly an origin, permission, or UI-trust boundary - is not correctly enforced, allowing an attacker-controlled context to present itself as a different, trusted one (spoofing). The scope change (S:C) in the CVSS vector implies the failure lets the attacker affect a security authority other than the one containing the bug, consistent with cross-origin or address-bar/UI spoofing. The single affected CPE is cpe:2.3:a:microsoft:microsoft_edge_(chromium-based) with an unspecified version, so exact build boundaries must be read from the MSRC advisory.

RemediationAI

Patch available per vendor advisory: update Microsoft Edge (Chromium-based) to the fixed build published by Microsoft at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58282 (the exact fixed version is not stated in the provided data and should be read from that advisory). Edge auto-updates by default, so ensure automatic updates are enabled and force a relaunch to apply the update; in managed environments, push the updated channel via your standard browser update tooling (Intune/WSUS/enterprise update policy) and verify the effective version through edge://settings/help. As a compensating measure until patched, avoid navigating to untrusted sites and treat address-bar/UI trust indicators with suspicion, since the flaw enables spoofing; there are no advertised feature-level workarounds, so prompt updating is the reliable control.