Microsoft Edge EUVD-2026-41598

Exploitation requires that the victim user be running an unpatched version of Microsoft Edge (Chromium-based) below 150.0.4078.48 and must actively interact with attacker-controlled web content (UI:R), such as clicking a link or navigating to a malicious page. No authentication or special privilege is required from the attacker (PR:N). No non-default configuration is indicated as a prerequisite. Exploitation is limited by the mandatory user-interaction step - the victim must be induced to visit or interact with the malicious content, making passive drive-by exploitation without any click or navigation action inconsistent with the CVSS UI:R rating. Impact is confined to confidentiality (C:H); integrity and availability of the user's system are not affected.

The CVSS 3.1 score of 6.5 (Medium) reflects a moderate but real risk profile: network-reachable (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R), which materially reduces weaponization potential compared to fully passive exploits. The high confidentiality impact (C:H) with no integrity or availability impact is characteristic of a credential-harvesting or sensitive-data-exfiltration scenario enabled by convincing UI deception. No EPSS score was provided, so exploitation probability cannot be quantified independently. No CISA KEV listing and no known POC reduces urgency compared to actively exploited spoofing flaws (e.g., prior Edge spoofing CVEs that reached KEV). The combination of low AC and high C suggests that if a reliable phishing lure exists, exploitation would be straightforward, but the UI:R gate means mass-automated exploitation is constrained. Real-world priority is moderate: organizations with high phishing exposure or sensitive browser-accessible applications should prioritize patching; others can treat this as a standard patch-cycle update.

An attacker crafts a malicious web page that exploits the spoofing flaw to render a convincing imitation of a trusted site's login prompt or security dialog within the Edge browser chrome. The attacker delivers the link via phishing email or a compromised ad network; when the victim clicks the link and interacts with the page (satisfying the UI:R requirement), the spoofed interface captures sensitive credentials or tokens. No public POC has been identified at time of analysis, but the low attack complexity suggests a capable attacker could develop a reliable exploit with moderate effort.