This vulnerability (CVE-2026-42891) affects Microsoft Edge for Android (version 1.0.0) and is classified as CWE-451, which involves user interface misrepresentation of critical information. The flaw enables an attacker to spoof the user interface over a network, potentially misleading users about critical information. The CVSS v3.1 base score is 6.5, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Microsoft has published an official fix for this vulnerability as indicated in their security advisory.

The vulnerability allows an attacker to spoof the user interface in Microsoft Edge for Android, potentially misleading users by misrepresenting critical information. This could lead to unauthorized disclosure of sensitive information (high confidentiality impact) but has low impact on integrity and no impact on availability. Exploitation requires network access and has high attack complexity, with no privileges or user interaction needed.

An official fix is available from Microsoft for this vulnerability. Users and administrators should apply the security update provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42891 to remediate this issue.