This vulnerability (CVE-2026-45494) is classified as CWE-79, indicating improper neutralization of input during web page generation, commonly known as cross-site scripting (XSS). It affects Microsoft Edge (Chromium-based) version 1.0.0.0 and could allow an attacker to inject malicious scripts that may lead to spoofing attacks. The CVSS v3.1 base score is 5.4 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity. Microsoft has released an official fix for this vulnerability.

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the affected browser, potentially leading to spoofing attacks that compromise user trust and data confidentiality and integrity. There is no impact on availability. No known exploits have been reported in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45494 to remediate this vulnerability.