Insufficient UI Warning of Dangerous Operations in Microsoft Edge - CVE-2026-58597

Vulnerability details

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to insufficient ui warning of dangerous operations in Microsoft Edge (Chromium-based) when rendering an attacker-controlled webpage and activating autofill through user interaction. A remote attacker can trick the victim into visiting a crafted webpage and performing two tap gestures to perform spoofing.

Malicious JavaScript code may read information in the victim's browser associated with the vulnerable URL and send it to the attacker. User interaction is required to visit the attacker-controlled webpage and trigger autofill.

Affected software

How to mitigate CVE-2026-58597

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58597
• https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Edge