CVE-2026-0391

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-451

Affected software

Vendor	Product	Versions
Microsoft	Microsoft Edge (Chromium-based)	>= 1.0.0.0, < 143.0.3650.66

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-0391Vendor Advisory

Timeline

Published: Feb 5, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-03927.3eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or CVE-2026-03936.5The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to in CVE-2026-03945.3When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added CVE-2026-03964.3An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where CVE-2026-03974.3When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard in CVE-2026-03985.3Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor.CVE-2026-03994.9Multiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to improper bounds checking CVE-2026-04004.9A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall.CVE-2026-04014.9A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall.CVE-2026-04024.9A post-authentication Out-of-bounds Read vulnerability in SonicOS allows a remote attacker to crash a firewall.CVE-2026-04038.0An insufficient input validation vulnerability in NETGEAR Orbi routers allows attackers connected to the router's LAN to execute OS command CVE-2026-04048.0An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticate