CVE-2026-45494 is a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability affecting Microsoft Edge (Chromium-based). It allows cross-site scripting that could lead to spoofing attacks by executing malicious scripts in the context of the browser. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity with no impact on availability. Microsoft has published an official fix for this vulnerability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected browser, potentially leading to spoofing attacks that compromise confidentiality and integrity of user data. There is no known exploitation in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the update provided by Microsoft to remediate this vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45494 for the patch and update instructions.