CVE-2026-70331: CWE-1427: Improper Neutralization of Input Used for LLM Prompting in Microsoft Microsoft Edge (Chromium-based)

This vulnerability, identified as CWE-1427, concerns improper neutralization of input used in LLM prompting within Microsoft Edge (Chromium-based) on iOS. The flaw enables an unauthorized attacker to conduct spoofing attacks over a network by manipulating input that is not properly sanitized before being used in LLM prompts. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity with no impact on availability. Microsoft has published an official fix for this issue.

An attacker can exploit this vulnerability to perform spoofing attacks over a network, potentially misleading users or systems by presenting falsified information. The impact affects confidentiality and integrity but does not affect availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the update to Microsoft Edge (Chromium-based) for iOS to versions 150.0.4078.50 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.