Improper neutralization of input during web page generation in Microsoft Edge (Chromium-based) creates a cross‑site scripting flaw (CWE‑79) that enables an attacker to perform spoofing over a network.

Microsoft Edge (Chromium-based) is potentially impacted; no specific versions are disclosed, so any current unpatched release could be vulnerable. The advisory links Microsoft’s update guide for available patches.

The CVSS score of 5.4 indicates medium severity. The EPSS score of <1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the delivery of malicious or compromised web content over a network to the browser, requiring the user to load a page containing the crafted input before the exploit is successful.