The vulnerability is a user interface misrepresentation that allows an authorized attacker to present incorrect or misleading information within Microsoft Edge for Android. Because the browser can display falsified security prompts or navigation cues, a user may be tricked into performing actions such as entering credentials, downloading malware, or visiting a malicious site. This is a typical spoofing issue, identified with CWE‑451, leading to potential compromise of user trust and confidentiality.

Affected system is Microsoft Edge for Android (Chromium-based). All releases lacking the latest security patch are affected; specific version ranges are not listed in the advisory, so any version before the fix should be treated as vulnerable. The issue affects the browser running on Android devices.

The CVSS score of 5.5 indicates a moderate impact, and the EPSS score of less than 1% shows a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Likely attack requires the attacker to have authorized device or network access to influence the displayed UI. Given the low exploitation probability, the overall risk is moderate but not critical, yet it is advisable to mitigate promptly.