Low MSRC-CVE-2026-40416 1 CVE

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability

Published May 11, 2026 · Updated May 11, 2026

Vendor: Microsoft

Summary

Impact: Spoofing. Microsoft rating: Low. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

Details

What is the impact of this vulnerability?
When shortening RTL characters in domains, edge will display the wrong part of the domain in the omnibox.

What is the version information for this release?
148.0.3967.55: 148.0.3967.55, 05/11/2026: 05/11/2026, 148.0.7778.97: 148.0.7778.97

Security updates
148.0.3967.55 — https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security

Vulnerabilities 1

Medium 4.3

CVE-2026-40416

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability

User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

Microsoft Microsoft Edge (Chromium-based) Browsers

May 12, 2026

Revision history

2026-05-11 #1
Information published.

References

CVE-2026-40416 Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40416
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss