CVE-2022-23258
Published: 25 January 2022
Summary
CVE-2022-23258 is a medium-severity an unspecified weakness vulnerability in Microsoft Edge. Its CVSS base score is 4.3 (Medium).
Operationally, ranked in the top 22.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Microsoft Edge for Android contains a spoofing vulnerability tracked as CVE-2022-23258. The flaw received a CVSS 3.1 base score of 4.3 with the vector string AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating a network-reachable issue that requires user interaction but no authentication. No specific CWE has been assigned.
An unauthenticated remote attacker can leverage the vulnerability by serving crafted content that the browser renders in a misleading way, resulting in limited integrity impact such as spoofed information presented to the user. Exploitation therefore depends on a victim visiting a malicious or compromised site with the vulnerable Edge for Android client.
Microsoft published remediation guidance in the MSRC advisories linked at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23258 and https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-23258. The EPSS score for this CVE rose from a low baseline after disclosure to a peak of 0.0553 on 2025-01-22 before receding to its current value of 0.0106, indicating a period of increased exploitation interest well after the original publication date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-28345
Vulnerability details
Microsoft Edge for Android Spoofing Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.