An incomplete list of disallowed inputs in Microsoft Edge (Chromium‑based) permits an attacker to bypass a browser security feature when exchanging data over a network. The flaw does not enable direct code execution or data exfiltration, but it allows manipulation of input that the browser would normally reject, potentially leading to unintended actions within the browsing session.

Microsoft Edge (Chromium‑based) is affected. No specific version information was provided, so any installation of the Chromium‑based Edge may be vulnerable.

The CVSS score of 8.8 reflects high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote over a network, exploiting the browser’s input handling. While no exploits are publicly reported, the practical risk remains high for environments that rely on Edge for sensitive or high‑exposure workloads.