CVE-2026-70331: CWE-1427: Improper Neutralization of Input Used for LLM Prompting in Microsoft Microsoft Edge (Chromium-based)

This vulnerability, tracked as CVE-2026-70331, affects Microsoft Edge (Chromium-based) on iOS. It is caused by improper neutralization of input used in LLM prompting, categorized under CWE-1427. The flaw could enable an attacker to conduct spoofing attacks remotely. The CVSS 3.1 base score is 5.4 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity. An official fix has been released by Microsoft.

An attacker could exploit this vulnerability to perform spoofing attacks over a network, potentially misleading users or systems by manipulating LLM prompts. The impact affects confidentiality and integrity but does not affect availability. No known exploits are reported in the wild.

An official fix is available and should be applied to affected versions of Microsoft Edge (Chromium-based) on iOS. Users and administrators are advised to update to the patched version to remediate this vulnerability.