MSRC-CVE-2026-56646 — Microsoft Edge (Chromium-based) Spoofing Vulnerability

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

Details

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
The user must visit the attacker‑controlled webpage, and perform the two tap gestures that cause autofill to activate.

What is the version information for this release?
150.0.4078.48: 150.0.4078.48, 07/03/2026: 07/03/2026, 150.0.7871.47: 150.0.7871.47

Security updates
150.0.4078.48 — https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security

Vulnerabilities 1

Medium 6.5

CVE-2026-56646

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

Microsoft Microsoft Edge (Chromium-based) Browsers

Jul 3, 2026

Revision history

2026-07-03 #1
Information published.

References

CVE-2026-56646 Microsoft Edge (Chromium-based) Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56646
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss