CVE-2026-58297: Microsoft Edge Android Privacy Vulnerability – CVSS 7.1 (HIGH)

Technical summary

CVE-2026-58297 is an information disclosure vulnerability in Microsoft Edge for Android (Chromium-based) that stems from improper handling of private personal information. The vulnerability is classified under CWE-359 (Privacy Violation) and has a CVSS 3.1 score of 7.1 (HIGH severity). The attack vector is network-based with low complexity and does not require privileges, but does require user interaction. The impact is high confidentiality loss with minor integrity exposure, while availability is not affected.

Business impact

For organizations deploying Microsoft Edge on Android devices—particularly in bring-your-own-device (BYOD) or corporate mobile programs—this vulnerability poses a risk of employee personal data leakage. Affected users could have sensitive information (contacts, browsing history, authentication tokens, or application data) intercepted or stolen by network-based attackers. In regulated industries, such data exposure may trigger compliance reporting obligations and breach notification requirements. The requirement for user interaction limits mass exploitation but does not eliminate risk in targeted scenarios.

Affected systems

The vulnerability affects Microsoft Edge (Chromium-based version) on Android devices. The associated Android operating system is also listed in the affected products, indicating the issue may be specific to certain Android versions or configurations. Organizations should verify which Edge versions in their environment correspond to vulnerable builds through the Microsoft security advisory.

Exploitability

Exploitation requires network-level access and user interaction—typically tricking a user into visiting a specially crafted website or clicking a malicious link. No authentication, privileges, or complex manipulation is required from the attacker perspective. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting no evidence of in-the-wild exploitation at the time of publication, though this does not guarantee future attack likelihood.

Remediation

Apply security updates from Microsoft as soon as they become available. Users should upgrade Microsoft Edge on Android to a patched version released after the vulnerability disclosure. Beyond patching, organizations should review mobile security policies, enforce HTTPS everywhere, and consider network-based filtering of known malicious sites. For high-risk environments, temporarily restricting Edge usage on Android until patches are validated may be prudent.

Patch guidance

Monitor Microsoft's official security advisories for Edge-specific patches addressing CVE-2026-58297. Patches will typically be rolled out through the Google Play Store and should be deployed promptly to all Android devices running Edge in your environment. Verify patch applicability against your current Edge version number (compare against the vendor advisory to confirm you are on a fixed build). Test patches in a small pilot group before full deployment to ensure compatibility with your mobile device management (MDM) solution and corporate apps.

Detection guidance

Monitor for suspicious network traffic originating from Edge on Android (look for unusual data exfiltration patterns). Check MDM logs for unpatched Edge installations and cross-reference against patch deployment records. Network-based detection is limited; focus on vulnerability scanning and asset inventory to identify vulnerable devices. Consider leveraging mobile threat defense solutions that can detect anomalous data access patterns or network exfiltration from the Edge browser.

Why prioritize this

This vulnerability merits timely but not emergency patching. The HIGH severity score reflects the significant confidentiality impact, but the requirement for user interaction and lack of active exploitation in the wild reduce immediate risk. Prioritize based on your organization's Android user base size, the sensitivity of data accessible via Edge on those devices, and your compliance obligations. In BYOD programs, prioritize communication and user-friendly patch deployment to ensure adoption.

Risk score, explained

The CVSS 7.1 (HIGH) score reflects the combination of high confidentiality impact (private information disclosed), low-complexity network attack vector, and minimal barriers to exploitation. The presence of user interaction prevents a critical rating despite the sensitive nature of the data at risk. The vulnerability does not impact system integrity or availability, further supporting the HIGH (not CRITICAL) classification.

Frequently asked questions