Microsoft Edge for Android spoofing flaws patched across multiple CVEs

Microsoft has disclosed and patched multiple spoofing vulnerabilities affecting Microsoft Edge for Android, including CVE-2026-35429, CVE-2026-42891, CVE-2026-0391, CVE-2025-47967, and the earlier CVE-2024-21387. The issues are described as user interface misrepresentation flaws that could let an unauthenticated attacker present misleading content over a network, potentially tricking users who visit attacker-controlled pages. The repeated classification points to browser UI spoofing risks in the Android version of Edge rather than code execution or privilege escalation.

For CVE-2026-35429, Microsoft said the flaw was rated Moderate with a CVSS v3.1 score of 4.3, required user interaction, and had low attack complexity with no privileges required. Microsoft also stated the vulnerability was not publicly disclosed and not exploited at the time of publication, and released a fix in Microsoft Edge for Android version 148.0.3967.55. The additional CVE entries indicate a broader pattern of Edge for Android spoofing issues being tracked and remediated through Microsoft’s Security Update Guide.