Summary
Impact: Spoofing. Microsoft rating: Low. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it.
According to the CVSS metrics, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L)? What does that mean for this vulnerability?
Information in the victim's browser associated with the vulnerable URL can be read by the malicious JavaScript code and sent to the attacker.
What is the version information for this release?
138.0.3351.55: 138.0.3351.55, 6/26/2025: 6/26/2025, 138.0.7204.49/.50: 138.0.7204.49/.50
Security updates
138.0.3351.55 — https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security
Vulnerabilities 1
-
Medium 6.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Revision history
-
#1
Information published.
References
-
CVE-2025-47963 Microsoft Edge (Chromium-based) Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47963
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss