This vulnerability, identified as CVE-2026-45489 and classified under CWE-749 (Exposed Dangerous Method or Function) and CWE-290, affects Microsoft Edge (Chromium-based). It is a spoofing vulnerability that could allow an attacker to deceive users by exploiting an exposed dangerous method or function. The CVSS 3.1 base score is 6.5, indicating medium severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact but no integrity or availability impact. Microsoft has published an official fix for this vulnerability.

An attacker can exploit this vulnerability remotely over the network without privileges but requires user interaction to trigger the spoofing condition. The impact is primarily on confidentiality, potentially allowing information disclosure through spoofing. There is no impact on integrity or availability. No known exploits are reported in the wild at this time.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the provided security update from Microsoft promptly to mitigate the risk. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45489 for detailed patch information and update instructions.