CVE-2025-29796: Microsoft Edge iOS Auth Bypass Vulnerability

CVE-2025-29796 Overview

CVE-2025-29796 is a user interface spoofing vulnerability in Microsoft Edge for iOS. The flaw stems from the browser misrepresenting critical information in its user interface, allowing an unauthorized network attacker to conduct spoofing attacks. The weakness maps to [CWE-451], which covers user interface misrepresentation of critical information. Exploitation requires user interaction, such as visiting a malicious webpage or clicking a crafted link. Microsoft published the advisory on April 4, 2025, and rates the issue as Medium severity.

Critical Impact
Attackers can spoof trusted user interface elements in Microsoft Edge for iOS to trick users into disclosing credentials or trusting malicious content.

Affected Products

Microsoft Edge for iOS (iPhone OS)
Mobile Chromium-based Edge builds prior to the April 2025 security release
iOS devices running vulnerable Edge versions distributed through the App Store

Discovery Timeline

2025-04-04 - CVE-2025-29796 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29796

Vulnerability Analysis

The vulnerability is a User Interface Confusion issue classified under [CWE-451]. Microsoft Edge for iOS presents security-relevant information, such as the address bar, origin indicators, or security dialogs, in a way that can mislead users. An attacker who controls a webpage or crafted content can manipulate what Edge displays to make untrusted content appear trustworthy.

Because the vulnerability lives in the mobile browser UI rather than a memory-corruption path, it does not grant code execution. The impact is limited to integrity of information presented to the user. Successful exploitation can support phishing campaigns, credential theft, and other social engineering workflows that depend on the user trusting the browser chrome.

User interaction is required, and the scope changes because the attacker's content influences a security boundary outside its own origin. The exploit prediction score (EPSS) is 0.561% at the 42.979 percentile as of July 21, 2026, indicating moderate but not elevated exploit activity expectations.

Root Cause

The root cause is improper representation of security-critical UI elements. Edge for iOS fails to enforce consistent, unambiguous rendering of origin and trust indicators when specific content or navigation states are triggered by a remote page. This lets attacker-controlled content overlap or overwrite the visual cues users rely on to judge site authenticity.

Attack Vector

The attack vector is network-based. An attacker hosts a malicious page and lures an Edge for iOS user to it through a link in email, SMS, messaging apps, or search results. Once loaded, the page manipulates rendering behavior so that Edge displays misleading origin, URL, or security state information. The user, believing they are on a legitimate site, may enter credentials or perform actions that expose sensitive data.

No verified proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update CVE-2025-29796 advisory for vendor-specific technical details.

Detection Methods for CVE-2025-29796

Indicators of Compromise

Mobile browsing sessions where users report the address bar or site identity appearing inconsistent with the actual destination
Outbound connections from iOS Edge to domains that closely mimic legitimate brands, such as look-alike or homoglyph domains
Credential submissions from mobile Edge sessions to newly registered or low-reputation domains

Detection Strategies

Correlate mobile web proxy logs with threat intelligence feeds to flag Edge for iOS traffic to phishing infrastructure
Monitor identity provider logs for successful authentications originating from iOS Edge user agents followed by anomalous session behavior
Track user-reported phishing incidents in which the victim used Microsoft Edge on iPhone or iPad

Monitoring Recommendations

Ingest mobile browser and MDM telemetry into a centralized data lake to detect spoofing-driven credential theft patterns
Alert on Edge for iOS versions in the fleet that predate the April 2025 security update
Watch identity telemetry for MFA challenges and password resets that follow suspicious mobile browsing events

How to Mitigate CVE-2025-29796

Immediate Actions Required

Update Microsoft Edge for iOS to the latest version available in the Apple App Store
Enforce automatic app updates through Mobile Device Management (MDM) for managed iPhones and iPads
Communicate to users that they should verify site legitimacy through means other than the browser address bar until updates are applied

Patch Information

Microsoft has released a fixed version of Edge for iOS. Consult the Microsoft Security Update CVE-2025-29796 advisory for the exact patched build number and update guidance. Deploy the update through MDM policies or user-driven App Store updates.

Workarounds

Restrict access to sensitive corporate applications from mobile Edge until the patched version is confirmed installed
Require phishing-resistant MFA, such as FIDO2 or platform authenticators, to reduce impact of credential theft via UI spoofing
Train users to inspect full URLs and avoid entering credentials into sites reached from unsolicited links on mobile devices

bash

# Example MDM query to identify vulnerable Edge for iOS versions
# Replace <PATCHED_VERSION> with the fixed build from Microsoft's advisory
mdm-cli devices list \
  --platform ios \
  --app com.microsoft.msedge \
  --app-version-lt <PATCHED_VERSION> \
  --output csv > vulnerable_edge_ios_devices.csv