This vulnerability involves improper control of code generation in Microsoft Edge (Chromium-based), specifically version 1.0.0.0. The flaw allows an attacker to inject code, leading to spoofing attacks over a network. The CVSS vector indicates the attack can be performed remotely with low attack complexity and no privileges required, but user interaction is needed. Confidentiality and integrity impacts are low, with no availability impact. Microsoft has released an official fix for this issue.

An attacker can exploit this vulnerability to perform spoofing attacks over a network, potentially misleading users or systems by injecting unauthorized code. The impact affects confidentiality and integrity to a limited extent but does not affect availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the patch provided by Microsoft to remediate this vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65804 for detailed update instructions.