EUVD-2026-43766
GHSA-g43g-5f3q-rwxv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Network-delivered UI-redress spoofing needing victim interaction (UI:R, PR:N, AC:L); integrity of displayed content is compromised (I:H) but no confidentiality loss and no genuine availability impact for spoofing, so A:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper restriction of rendered ui layers or frames in Microsoft Bing App for IOS allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Spoofing in the Microsoft Bing Search app for iOS lets a remote attacker present deceptive or overlaid UI content that misleads the victim, because the app improperly restricts how rendered UI layers or frames are displayed (CWE-1021, a UI-redressing/clickjacking class of flaw). An unauthenticated attacker who lures a user into interacting with attacker-controlled content can manipulate what the user sees and trusts, potentially inducing them to act on falsified information. Microsoft has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The affected component is the Microsoft Bing Search application for iOS (CPE cpe:2.3:a:microsoft:microsoft_bing_search_for_ios). The root cause is CWE-1021, Improper Restriction of Rendered UI Layers or Frames, the weakness class behind clickjacking and UI-redress attacks, where content the app renders (typically an embedded WebView or framed/overlaid layer) is not properly constrained, allowing one layer to obscure, overlay, or impersonate another. The 'XSS' and 'Apple' tags in the intelligence, combined with the network attack vector, indicate the attack surface is web-rendered content loaded and framed within the iOS app rather than the native OS itself.
RemediationAI
Patch available per vendor advisory: update the Microsoft Bing Search app for iOS to the fixed release via the Apple App Store as identified in the Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58595 (confirm the exact fixed build number there, as it was not included in the provided data). Enabling automatic App Store updates on managed iOS fleets ensures the fix propagates without user action; MDM administrators can push or enforce the update to accelerate coverage. As an interim compensating control until devices are updated, advise users not to interact with unexpected prompts, overlays, or links rendered inside the app and to treat in-app content requesting sensitive actions with suspicion - the trade-off is that this relies on user vigilance and does not technically block the flaw, so it is only a stopgap ahead of patching.
Share
External POC / Exploit Code
Leaving vuln.today