The vulnerability is an improper neutralization of special elements in output used by a downstream component (injection) in Microsoft Edge (Chromium-based). An attacker who is not authorized and can send crafted content over a network can use the flaw to elevate privileges beyond their normal rights.

Microsoft Edge (Chromium-based). No specific version information is disclosed in the data, so all releases of the Chromium-based Edge are potentially affected.

The CVSS score is 5.4, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is not explicitly defined in the description, but based on the nature of the flaw, it is likely that an attacker sends or injects malicious content over a network that the Edge browser renders, enabling privilege escalation. The lack of an available EPSS score and KEV status suggests that this flaw is not yet widely exploited in the wild, but the moderate CVSS score means it can still be a risk for targeted attacks.