{"id":"CVE-2026-20942","kind":"vulnerability","aliases":["CVE-2026-20942"],"related":[],"title":"Microsoft Edge: rendered UI layers flaw lets attacker spoof over network","description":"Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.","summary":"Microsoft Edge (Chromium-based) does not properly restrict rendered UI layers or frames, which allows an unauthorized attacker to perform spoofing over a network. The sources give no further detail on what is spoofed or what the attacker gains beyond that.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chromium","desktop-browser","microsoft-edge","runtime","windows"],"not_affected_if":[],"how_to_check":"- Check the installed Edge version via Edge settings (edge://settings/help) and compare it against the fixed version named in the vendor advisory.","fix":null,"status":"open","published_at":"2026-10-29T16:18:08+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:32:02+00:00","updated_at":"2026-10-29T16:32:02+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-29T16:32:02Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Microsoft Edge: rendered UI layers flaw lets attacker spoof over network","impact":"low","summary":"Microsoft Edge (Chromium-based) does not properly restrict rendered UI layers or frames, which allows an unauthorized attacker to perform spoofing over a network. The sources give no further detail on what is spoofed or what the attacker gains beyond that.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["microsoft-edge","chromium","windows","desktop-browser"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker performs spoofing over the network against Edge users","analyst_note":"Confirm the fixed Edge version and the exact spoofing impact from the NVD entry or the Microsoft advisory for CVE-2026-20942.","how_to_check":"- Check the installed Edge version via Edge settings (edge://settings/help) and compare it against the fixed version named in the vendor advisory.\n- unknown","plain_action":"Update Microsoft Edge to the latest version through its built-in update check.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Anyone running a Chromium-based Microsoft Edge build that is not yet updated. The sources do not describe any special configuration, so default installs are presumed in scope. unknown beyond that.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000674,"input_tokens":4087,"output_tokens":531,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-20942':14A,17A 'allow':42B,82C 'attack':8A,45B,65B,85C 'base':31B,81C 'beyond':67B 'browser':21B 'chromium':18B,30B,80C 'chromium-bas':29B,79C 'cve':12A,15A 'desktop':20B 'desktop-brows':19B 'detail':57B 'edg':2A,24B,28B,78C 'flaw':6A 'frame':40B,75C 'gain':66B 'give':54B 'improp':68C 'layer':5A,38B,73C 'let':7A 'microsoft':1A,23B,27B,77C 'microsoft-edg':22B 'network':11A,51B,91C 'perform':47B,87C 'proper':34B 'render':3A,36B,71C 'restrict':35B,69C 'runtim':25B 'sourc':53B 'spoof':9A,48B,61B,88C 'ui':4A,37B,72C 'unauthor':44B,84C 'window':26B","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Chromium-based Microsoft Edge build that is not yet updated. The sources do not describe any special configuration, so default installs are presumed in scope. unknown beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Update Microsoft Edge to the latest version through its built-in update check.","first_public_at":"2026-10-29T16:18:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-20942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20942","severity":null,"published_at":"2026-10-29T16:18:08+00:00","modified_at":"2026-10-29T16:18:08+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}