Description

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-28T20:19:34.407Z",
  "pubdate": "2026-08-28T20:19:34.407Z",
  "executiveSummary": "This vulnerability involves improper external control of file names or paths within the Microsoft Edge (Chromium-based) browser, facilitating a spoofing attack over a network.\nThe flaw allows an unauthorized remote attacker to manipulate file path references, potentially deceiving users by presenting misleading or illegitimate file locations or identities.\nThe vulnerability resides in how the browser handles user-influenced or externally controlled path inputs, which can be leveraged to compromise the integrity of the browser's user interface or file interaction mechanisms.\nThe impact includes the potential for social engineering and phishing, where a user may be led to believe they are interacting with a trusted resource when they are actually accessing malicious or spoofed content.\nSuccessful exploitation requires the attacker to influence the file name or path inputs processed by the browser, typically occurring in the context of network-based interactions.\nThere is no requirement for high-level local privileges; the vulnerability is exposed via the network, significantly lowering the barrier for exploitation by remote actors.\nRisk implications include loss of user trust, potential for credential theft, and unauthorized delivery of malicious payloads through disguised file handles.",
  "technicalDetails": "The vulnerability originates from a failure in input validation or path normalization logic within Microsoft Edge when handling externally provided file name or path parameters. In Chromium-based architectures, the browser must rigorously validate path strings before they are utilized in file system operations or UI rendering components.\nThe root cause is the insufficient sanitization of input vectors that dictate how file handles or paths are parsed by the browser's underlying engine. By injecting malicious path structures or directory traversal sequences, an attacker can coerce the browser into interpreting a spoofed path as a legitimate system or web resource.\nThe attack flow initiates when the attacker leverages a network-based vector—such as a crafted URL or a compromised web resource—to send a malicious file path or file name argument to the browser. The browser, failing to strictly validate the authenticity or constraints of this path, processes the input as a trusted reference.\nOnce processed, the browser may render this spoofed path in the address bar, download dialogs, or other security-critical UI elements. Because the browser's internal logic erroneously validates the integrity of the path string, the user is presented with misleading information that effectively disguises the actual origin or destination of the data.\nIn a post-exploitation scenario, the attacker can leverage the spoofing capability to bypass security warnings, masquerade as legitimate software update mechanisms, or trick the user into executing what they believe is a trusted local file. The malicious payload behavior is contingent on the attacker's ability to redirect browser interaction toward a controlled or malicious destination while maintaining the illusion of authenticity.\nThe vulnerability is exposed over the network, meaning no prior authentication or administrative privileges on the target system are required by the attacker. By controlling the external input source, the attacker can systematically deceive the browser's file path resolution logic, leading to a breakdown in user perception and security-boundary enforcement."
}