This vulnerability (CWE-79) in Microsoft Edge (Chromium-based) arises from improper neutralization of input during web page generation, enabling cross-site scripting attacks. Exploitation could allow attackers to spoof content, potentially misleading users. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on integrity with limited impact on confidentiality and no impact on availability. Microsoft has published an official fix for this vulnerability.

Successful exploitation could allow an attacker to perform spoofing attacks by injecting malicious scripts into web pages viewed by users, potentially compromising the integrity of displayed content. The confidentiality impact is low, and availability is not affected. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as detailed in the vendor advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57977) to remediate this vulnerability.