Access of a resource using an incompatible type, also known as type confusion, in Microsoft Edge (Chromium-based) enables an unauthorized attacker to disclose sensitive information over a network. The flaw permits the attacker to read data that the browser is not intended to expose, potentially leaking confidential or proprietary data. Because the vulnerability is limited to a type mismatch in an internal resource, it does not provide an attacker with direct code execution or persistence capabilities, but the disclosed data can be valuable for further attacks.

The vulnerability affects all versions of Microsoft Edge based on the Chromium engine. No specific release or patch level is specified in the advisory, so any deployment of the Chromium‑based Edge that has not yet received the latest security update is potentially vulnerable. Microsoft is treating the issue as high impact and recommends installing the next available update.

The vulnerability carries a CVSS score of 7.4, reflecting a high risk to confidentiality. The EPSS score is not available, so the current exploitation likelihood is uncertain. The issue is not listed in the CISA KEV catalog, indicating that no widespread exploits are known at this time. The attack vector is inferred to arise when an attacker serves maliciously crafted web content or files that cause Edge to access a resource using an incorrect type. When triggered, the browser can transmit the leaked data to a remote address controlled by the attacker.