This vulnerability, tracked as CVE-2026-42891 and categorized under CWE-451, affects Microsoft Edge for Android version 1.0.0. It involves a user interface misrepresentation flaw where critical information is displayed incorrectly, enabling an attacker to spoof content or UI elements over a network. The CVSS 3.1 base score is 6.5, indicating medium severity, with network attack vector, high attack complexity, no privileges or user interaction required, and high confidentiality impact but low integrity impact. Microsoft has released an official fix for this vulnerability.

An attacker exploiting this vulnerability can perform UI spoofing attacks that may deceive users into believing false information, potentially leading to unauthorized actions or disclosure of sensitive data. The confidentiality impact is high, but integrity and availability impacts are low. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the vendor-provided update for Microsoft Edge for Android version 1.0.0 as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42891 to remediate this vulnerability.