This vulnerability (CVE-2026-0391) affects Microsoft Edge (Chromium-based) on Android and is classified under CWE-451, which involves user interface misrepresentation of critical information. An attacker can exploit this flaw remotely over a network to spoof the user interface, potentially misleading users about critical information displayed by the browser. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity and no privileges or user interaction, impacting confidentiality with low integrity impact and no availability impact. The vulnerability is officially patched by Microsoft.

Successful exploitation can lead to spoofing attacks where critical UI information is misrepresented, potentially causing users to be deceived by falsified content or indicators within the browser. This impacts confidentiality by potentially exposing or misleading users about sensitive information. There is no impact on availability, and integrity impact is low. No known active exploits have been reported.

An official patch is available for this vulnerability. Users and administrators should apply the latest updates for Microsoft Edge on Android to remediate this issue. Since the vulnerability is patched, no additional mitigations are required beyond applying the update.