This vulnerability, identified as CWE-918, affects Microsoft Edge (Chromium-based) and enables an attacker without privileges to perform server-side request forgery, leading to spoofing over a network. The CVSS 3.1 base score is 5.4, indicating a medium severity with network attack vector, low attack complexity, no privileges required, but user interaction needed. The vulnerability impacts integrity and availability but not confidentiality. Microsoft has published an official fix to address this issue.

The SSRF vulnerability can allow an attacker to cause spoofing on the network, potentially leading to limited integrity and availability impacts. Confidentiality is not affected. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Microsoft Edge (Chromium-based) as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58278. No additional mitigation steps are indicated by the vendor.