This vulnerability (CWE-451) in Microsoft Edge (Chromium-based) allows an attacker to spoof critical UI information, potentially misleading users. The issue is exploitable remotely without privileges and requires user interaction. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. Microsoft has published an official fix to remediate this vulnerability.

The vulnerability enables an attacker to perform UI spoofing over a network, potentially tricking users into believing false information presented by the browser. There is no direct impact on confidentiality or availability, but the integrity of the user interface is compromised, which could facilitate social engineering or phishing attacks.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40416 to remediate this vulnerability.