Summary
Impact: Spoofing. Microsoft rating: Moderate. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metrics, successful exploitation of this vulnerability could lead to no loss of confidentiality (C:N) and integrity (I:N), but could lead to some loss of availability (A:L). What does that mean for this vulnerability?
An attacker using either a specially-crafted page or a content script injected into a target page can show an extension's popup over a permission prompt or screen share dialog allowing the extension to spoof parts of the prompt's UI that shows its origin.
Security updates
156.0.4314.42 — https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security
Vulnerabilities 1
-
Medium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Revision history
-
#2
CWE added. Informational change only.
-
#1
Information published.
References
-
CVE-2026-88078 Microsoft Edge (Chromium-based) Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88078
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss