This vulnerability, identified as CWE-918, involves server-side request forgery in Microsoft Edge (Chromium-based). It enables an unauthorized attacker to perform spoofing over a network, potentially causing confidentiality impact without affecting integrity or availability. The vulnerability has been assigned CVE-2026-57987 and has a CVSS v3.1 base score of 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, high confidentiality impact, no integrity or availability impact, and official remediation level with confirmed fix. Microsoft has published an official fix for this vulnerability.

The vulnerability allows an attacker to perform server-side request forgery leading to network spoofing, which can result in unauthorized disclosure of information (high confidentiality impact). There is no impact on integrity or availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the patch provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57987 to remediate this vulnerability.