This vulnerability, identified as CWE-79, involves improper neutralization of input during web page generation in Microsoft Edge (Chromium-based). It allows an attacker to conduct cross-site scripting attacks that can lead to spoofing over a network. The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity. Microsoft has published an official fix for this vulnerability.

Successful exploitation of this vulnerability can allow an attacker to perform spoofing attacks, potentially misleading users or systems by injecting malicious scripts into web pages. This can compromise confidentiality and integrity of data processed by the browser. There is no indication of impact on availability. No known exploits in the wild have been reported.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58298 to remediate this vulnerability.