This vulnerability in Microsoft Edge (Chromium-based) arises from improper control of code generation, enabling an attacker to inject code that can lead to spoofing attacks over a network. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity with no impact on availability. Microsoft has published an official fix to address this issue.

An attacker exploiting this vulnerability could perform spoofing attacks over a network, potentially misleading users or systems by presenting false information. The impact includes partial loss of confidentiality and integrity but does not affect availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the provided security update as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65804 to remediate this vulnerability.