CVE-2026-88078: Microsoft Edge (Chromium-based) Spoofing Vulnerability

Overview

Severity

Medium (CVSS 4.3)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C

Category

Spoofing

Exploit Status

Not Exploited

Patch Tuesday

2026-Oct

Released

2026-10-27

FAQ

According to the CVSS metrics, successful exploitation of this vulnerability could lead to no loss of confidentiality (C:N) and integrity (I:N), but could lead to some loss of availability (A:L). What does that mean for this vulnerability? An attacker using either a specially-crafted page or a content script injected into a target page can show an extension's popup over a permission prompt or screen share dialog allowing the extension to spoof parts of the prompt's UI that shows its origin.

Affected Products (1)

Browser

• Microsoft Edge (Chromium-based)

Security Updates (1)

• Release Notes

Acknowledgments

Nguyen Tai Phuc An (Krypt0nS3C)

Revision History

• 2026-10-27: Information published.