This vulnerability (CVE-2026-58298) involves improper neutralization of input during web page generation in Microsoft Edge (Chromium-based), classified as CWE-79 (Cross-site Scripting). It enables an attacker without privileges or user interaction to conduct spoofing attacks remotely. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with a scope change. Microsoft has published an official fix for this vulnerability.

Successful exploitation can lead to spoofing attacks that compromise the confidentiality and integrity of information processed by the browser. There is no impact on availability reported. The vulnerability can be exploited remotely without user interaction or privileges, increasing its risk.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58298 to remediate this vulnerability.