Cyber Resilience

CVE-2026-33119

Medium

Published: 10 April 2026

Published
10 April 2026
Modified
14 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS Score 0.0031 22.8th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-33119 is a medium-severity User Interface (UI) Misrepresentation of Critical Information (CWE-451) vulnerability in Microsoft Edge. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Spearphishing Link (T1566.002); ranked at the 22.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability details

User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

CWE(s)
CWE-451

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1566.002 Spearphishing Link Initial Access
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
attack.mitre.org →
T1684.001 Impersonation Stealth
Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf.
attack.mitre.org →
Why these techniques?

CWE-451 UI misrepresentation directly enables browser-based spoofing for phishing links and impersonation attacks.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Affected Assets

microsoft
edge
≤ 147.0.3912.60

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References