Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
What kind of security feature could be bypassed by successfully exploiting this vulnerability? Successful exploitation could bypass the path validation safeguards that check which files may be changed and require user approval for sensitive locations, allowing changes to protected files without the user’s knowledge or consent. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? The user must open or load attacker‑controlled content—such as importing a malicious WSDL or opening a file—so the application processes it and triggers the vulnerability.
Edge Security with Microsoft