EUVD-2026-67846
GHSA-wjm5-2899-cw52
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Network delivery with no attacker privileges, but requires user to trigger AI feature; spoofing yields limited confidentiality and integrity impact only.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Prompt injection in Microsoft Edge for iOS exposes users to network-based spoofing attacks through Microsoft Edge's AI/Copilot integration. Malicious web content can embed adversarial LLM prompts that, when processed by Edge's AI features, manipulate the model to produce spoofed or misleading output - potentially impersonating trusted content or bypassing AI-enforced guardrails. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | User must be running Microsoft Edge on an iOS device with Copilot or AI-powered features active and accessible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world priority for this vulnerability is moderate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the latest Microsoft Edge for iOS update, as a vendor-released patch is confirmed available per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70331. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Microsoft Edge For Ios
View allUse-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execu
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop a
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today