CVE-2026-0385

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-451CWE-290

Affected software

VendorProductVersions
MicrosoftMicrosoft Edge for Android>= 1.0.0, < 146.0.3856.59

References

Timeline

Published
Mar 16, 2026
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-03867.5Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network.CVE-2026-03906.7Reliance on untrusted inputs in a security decision in Windows Boot Loader allows an authorized attacker to bypass a security feature locallCVE-2026-03916.5User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofCVE-2026-03927.3eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated orCVE-2026-03936.5The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to inCVE-2026-03945.3When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added CVE-2026-03964.3An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where CVE-2026-03974.3When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard inCVE-2026-03985.3Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor.CVE-2026-03994.9Multiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to improper bounds checkingCVE-2026-04004.9A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall.CVE-2026-04014.9A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall.