CVE-2025-65046

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-65046", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2025-11-13T16:18:07.468Z", "datePublished": "2025-12-18T22:01:43.462Z", "dateUpdated": "2026-04-16T14:19:07.967Z"}, "containers": {"cna": {"title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "datePublic": "2025-12-18T16:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:edge:*:*:*:*:*:android:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "143.0.3650.88"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Edge for Android", "versions": [{"version": "1.0.0", "lessThan": "143.0.3650.88", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-451: User Interface (UI) Misrepresentation of Critical Information", "lang": "en-US", "type": "CWE", "cweId": "CWE-451"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-04-16T14:19:07.967Z"}, "references": [{"name": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-65046"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "LOW", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C"}}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-290", "lang": "en", "description": "CWE-290 Authentication Bypass by Spoofing"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-19T15:16:52.216233Z", "id": "CVE-2025-65046", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-19T15:17:17.340Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-65046", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-19T15:16:52.216233Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290 Authentication Bypass by Spoofing"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-19T15:17:11.186Z"}}], "cna": {"title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Edge for Android", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "143.0.3650.88", "versionType": "custom"}]}], "datePublic": "2025-12-18T16:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-65046", "name": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Microsoft Edge (Chromium-based) Spoofing Vulnerability"}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-451", "description": "CWE-451: User Interface (UI) Misrepresentation of Critical Information"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:edge:*:*:*:*:*:android:*:*", "vulnerable": true, "versionEndExcluding": "143.0.3650.88", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-04-16T14:19:07.967Z"}}}, "cveMetadata": {"cveId": "CVE-2025-65046", "state": "PUBLISHED", "dateUpdated": "2026-04-16T14:19:07.967Z", "dateReserved": "2025-11-13T16:18:07.468Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2025-12-18T22:01:43.462Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Microsoft Edge for Android", "vendor": "Microsoft", "versions": [{"lessThan": "143.0.3650.88", "status": "affected", "version": "1.0.0", "versionType": "custom"}]}], "source": "secure@microsoft.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:android:*:*", "matchCriteriaId": "7969635F-7F65-46EB-BBE8-60B2EAB807CA", "versionEndExcluding": "143.0.3650.88", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Microsoft Edge (Chromium-based) Spoofing Vulnerability"}, {"lang": "es", "value": "Microsoft Edge (basado en Chromium) Vulnerabilidad de suplantaci\u00f3n"}], "id": "CVE-2025-65046", "lastModified": "2026-09-30T23:10:00.237", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "secure@microsoft.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65046", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-19T15:16:52.216233Z", "version": "2.0.3"}}]}, "published": "2025-12-18T22:16:01.750", "references": [{"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-65046"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-451"}], "source": "secure@microsoft.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-290"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T15:39:05.399590+00:00", "value": {"mitigation_remediation": ["Ensure Microsoft Edge for Android is updated to the latest version, which contains the vendor\u2019s patch for this spoofing flaw.", "Enable Microsoft\u2019s \u201cSmartScreen\u201d or equivalent phishing protection in Edge settings to reduce the likelihood of user interaction with spoofed content.", "If Edge is not required on the device, uninstall or disable the browser and use Microsoft\u2019s recommended alternative Android browsers that receive timely security updates."], "summary": {"action": "Assess Impact", "impact": "Spoofing"}, "threat_synthesis": {"affected_systems": "Affected systems are Microsoft Edge for Android, a Chromium\u2011based browser distributed by Microsoft. No specific version range is listed in the CNA data, so all releases of the Android Edge browser at the time of disclosure are potentially impacted.", "description_and_impact": "The vulnerability allows an attacker to deceive users by presenting counterfeit content or identities within Microsoft Edge (Chromium-based) on Android devices. This can lead to users believing they are interacting with a legitimate site or source when they are not, potentially facilitating phishing or social engineering attacks. The weakness is classified under CWE-290 (Authentication Spoofing) and CWE-451 (Code Review Does Not Verify Critical Function). The design of the browser means that the spoofed content could appear seamless to the user, undermining trust and increasing the risk of credential disclosure if the user proceeds to enter personal information.", "risk_and_exploitability": "The CVSS base score of 3.1 indicates a low overall impact. The EPSS score of less than 1% suggests a very low probability that this weakness is being actively exploited in the wild, and it is not currently listed in the CISA KEV catalog. The likely attack vector is inferred to be through malicious or compromised web content rendered in the Edge Android browser, where the spoofed assets would be viewed by unsuspecting users. Because the flaw does not grant code execution or privilege escalation, the threat is confined to the user's trust and visibility within the web page rendered by the browser."}}}}, "created": "2026-04-20T15:45:10.380470+00:00", "updated": "2026-04-20T15:45:10.380480+00:00", "vendors": []}