Under certain conditions a malicious web page can trigger the autofill mechanism after the user taps twice on the page, potentially without clear or intentional user consent. When activated, stored autofill data—including addresses, email addresses, and phone number metadata—can be disclosed inadvertently. This vulnerability falls under CWE‑359, Sensitive Data Exposure, and allows an attacker to obtain personal data that the user has stored locally in the browser.

Microsoft Edge (Chromium-based) is the affected vendor and product. No specific version range is listed, so all installations of this browser may be vulnerable until a patch is applied.

The CVSS score is 3.1, indicating low severity, and the EPSS score is less than 1 %, suggesting a very low probability of exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to open a malicious or compromised web page and interact with it by tapping the page twice. The attack vector is therefore a web-based user interaction; no remote code execution or privilege escalation beyond data disclosure is possible according to the current description.