Microsoft Edge (Chromium-based) has an origin validation error that permits an attacker to bypass a security feature that is intended to restrict access to resources based on the origin of a request. Because the browser fails to enforce the expected origin checks, an unauthenticated adversary can potentially access data or functionality that should be restricted, thereby compromising confidentiality or integrity of the affected content. The weakness is classified as CWE‑346, which is an information‑exposure or direct‑object‑reference flaw derived from insecure validation of origins.

The impact applies to Microsoft Edge (Chromium-based) running on any platform where this origin validation logic is present. No specific product or revision numbers are identified, so all currently released versions of the Chromium‑based Edge browser are potentially vulnerable.

The CVSS score of 5.4 indicates a moderate risk level. EPSS information is unavailable and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting no confirmed widespread exploitation to date. The attack vector is likely network‑based, involving a malicious host or content that supplies crafted requests or responses to the browser. While the availability of an exploit is uncertain, the moderate severity underscores the need to verify system exposure and, if a patch is not immediately present, to mitigate the risk through network controls and monitoring.