CVE-2026-58296: Microsoft Edge Android Privacy Leak Vulnerability

Technical summary

CVE-2026-58296 represents a private personal information disclosure vulnerability in Microsoft Edge for Android, categorized under CWE-359 (Privacy Violation). The vulnerability has a CVSS 3.1 score of 7.1 (HIGH) with a network attack vector, low attack complexity, no privilege requirements, and required user interaction. The vulnerability achieves high confidentiality impact with minor integrity impact, and no availability impact. This indicates that while an attacker cannot modify or delete data directly, they can exfiltrate sensitive information when the user interacts with an attacker-controlled resource.

Business impact

Users of Microsoft Edge on Android devices face elevated risk of personal data exposure including browsing history, cached credentials, location data, or other stored personal information. For enterprises with BYOD policies or mobile workforce deployments, this vulnerability increases the surface area for data loss and privacy incidents. Customer trust and regulatory compliance (GDPR, CCPA, etc.) may be affected if user data is compromised at scale. The HIGH severity rating reflects the ease of exploitation and the sensitive nature of data exposure.

Affected systems

Microsoft Edge for Android running vulnerable versions is the primary affected platform. The vulnerability also involves the Google Android ecosystem as Edge for Android depends on Android's underlying system libraries and APIs. Users running current or near-current versions of Edge on Android devices should be considered at risk until patches are applied. Desktop versions of Edge and Edge on other platforms are not affected.

Exploitability

The vulnerability requires user interaction; an attacker cannot silently extract data from a device. However, the attack is triggered through ordinary network-based methods (visiting a malicious website, clicking a link, or interacting with crafted content). The low attack complexity and absence of authentication requirements make exploitation straightforward once user interaction is achieved. Social engineering, malvertising, or drive-by downloads could lower the practical barrier to triggering the vulnerability.

Remediation

Users should update Microsoft Edge for Android to the latest available version from the Google Play Store or equivalent distribution channel. Check the Microsoft Edge release notes or security advisory for specific version numbers that address CVE-2026-58296. Enterprises should enforce mobile device management (MDM) policies to push Edge updates automatically and restrict use of outdated browser versions on corporate devices.

Patch guidance

Verify the exact patched version numbers against the official Microsoft Edge security advisory, as version numbers vary by release channel and region. Most users will receive patches automatically if auto-update is enabled in the Google Play Store; verify this setting is active. For managed deployments, use MDM tools (Intune, MobileIron, etc.) to deploy patches immediately. Test patches in a small cohort before full rollout to ensure compatibility with line-of-business applications.

Detection guidance

Monitor for unusual data exfiltration from mobile devices running Edge, particularly outbound network connections to unexpected domains during or after a user's browsing session. Security information and event management (SIEM) systems with mobile visibility can flag suspicious data flows. On managed devices, deploy mobile threat defense (MTD) solutions that can detect the data access patterns associated with this vulnerability. Review browser cache and history logs for evidence of exposure. Look for authentication tokens or sensitive session data in unencrypted storage.

Why prioritize this

This vulnerability merits high-priority remediation due to its HIGH severity rating, direct impact on user privacy, low exploitation complexity, and lack of active exploitation data (not yet on CISA's KEV list). The requirement for user interaction does not significantly reduce risk in real-world scenarios where users frequently click links or visit websites. Organizations with mobile workforces, BYOD programs, or strict privacy compliance obligations should prioritize patching within 2–4 weeks.

Risk score, explained

A CVSS score of 7.1 reflects a HIGH-severity vulnerability with three key factors: (1) High confidentiality impact — sensitive personal data can be disclosed; (2) Low attack complexity — no special conditions or tools are required; (3) User interaction requirement — the attack must be socially engineered or delivered through a malicious link. The network attack vector means any internet-connected device is at risk. The lack of integrity or availability impact prevents a critical rating, but the privacy damage potential justifies urgent patching.

Frequently asked questions