CVE-2025-49755: 
NixOS vulnerability analysis and mitigation

CVE-2025-49755 is a User Interface (UI) misrepresentation vulnerability in Microsoft Edge for Android that allows an unauthorized network attacker to perform spoofing attacks. The flaw affects Microsoft Edge for Android versions prior to 139.0.3405.86. It was disclosed and patched on August 12, 2025, as part of Microsoft's August 2025 Patch Tuesday release. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Microsoft MSRC).

The vulnerability is classified under CWE-451 (User Interface Misrepresentation of Critical Information), meaning the browser fails to accurately represent critical security-relevant information to the user. An attacker can exploit this over a network by crafting malicious web content that causes Edge for Android to misrepresent UI elements — such as the address bar or security indicators — enabling spoofing. Exploitation requires user interaction (e.g., visiting a malicious page), but no privileges are required on the attacker's side. No public technical write-ups or proof-of-concept code have been identified at this time (Microsoft MSRC).

Successful exploitation allows an attacker to manipulate the browser's user interface, potentially tricking users into believing they are on a trusted or legitimate site when they are not. The primary impact is on integrity (CVSS integrity impact: Low), as users may be misled into disclosing credentials or sensitive information based on spoofed UI elements. There is no direct confidentiality or availability impact, and the scope is unchanged, limiting the blast radius to the affected browser session (Microsoft MSRC).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code for CVE-2025-49755. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038%, indicating a very low probability of exploitation in the near term. The vulnerability has not been attributed to any specific threat actor (Microsoft MSRC).

Microsoft has released a patch addressing this vulnerability in Microsoft Edge for Android version 139.0.3405.86 and later. Users should update their Edge for Android browser to the latest available version via the Google Play Store. As interim guidance, users should exercise caution when interacting with unfamiliar web content, verify critical information (such as URLs and security indicators) through alternative means, and keep all browser and OS software up to date (Microsoft MSRC).

CVE-2025-49755 was noted as part of Microsoft's August 2025 Patch Tuesday, which addressed 107 vulnerabilities in total. Coverage was primarily aggregated in Patch Tuesday roundup articles by outlets such as BleepingComputer, Rapid7, and GBHackers, with no specific in-depth analysis dedicated to this individual CVE. Community discussion on WindowsForum highlighted the UI spoofing risk and recommended immediate updating (BleepingComputer, Rapid7, WindowsForum).