This vulnerability, identified as CWE-79, involves improper neutralization of input during web page generation in Microsoft Edge (Chromium-based). It enables an attacker to conduct cross-site scripting attacks that can lead to spoofing over a network. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impact primarily on integrity with limited confidentiality impact. Microsoft has published an official fix addressing this issue.

Successful exploitation allows an attacker to perform spoofing attacks by injecting malicious scripts into web pages viewed by users, potentially compromising the integrity of the affected system or user session. Confidentiality impact is limited, and availability is not affected. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the patch provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57977 to remediate this vulnerability.