CVE-2026-58299: Microsoft Edge Android TOCTOU Race Condition Remote Code Execution

Technical summary

CVE-2026-58299 is a TOCTOU race condition (CWE-367) in Microsoft Edge for Android. The vulnerability exists where a security validation occurs at check time, but the resource or operation is used at a different time, creating an exploitable gap. An attacker positioned to conduct a network-based attack can craft malicious input or conditions that pass the initial security check but are manipulated before actual use, resulting in code execution. The CVSS 3.1 score of 7.5 (HIGH) reflects the network attack vector, high computational complexity required for exploitation (AC:H), mandatory user interaction, and the potential for complete compromise of confidentiality, integrity, and availability within the browser process.

Business impact

Compromise of Microsoft Edge for Android could expose users to data theft, malware installation, and unauthorized access to browsing data and credentials. Organizations supporting Android-based workforces face increased risk if employees use Edge as their primary mobile browser for accessing corporate resources. The requirement for user interaction somewhat limits mass exploitation, but determined attackers targeting specific high-value users could leverage this vulnerability as part of a multi-stage attack. The mobile form factor means affected devices are often personal or bring-your-own-device (BYOD), potentially expanding exposure beyond traditional corporate network boundaries.

Affected systems

The vulnerability affects Microsoft Edge for Android (Chromium-based). Google Android itself is listed as an affected vendor product, though the vulnerability is specifically in the Edge browser application rather than the Android OS core. Organizations and individuals using Microsoft Edge as their mobile browser on Android devices are at risk. The scope is limited to the Edge browser process; other Android applications and system components are not directly affected unless they similarly contain the same TOCTOU pattern.

Exploitability

Exploitation requires network accessibility and user interaction—an attacker cannot trigger the vulnerability passively. The high attack complexity (AC:H) indicates that successful exploitation demands precise timing and potentially multiple attempts to win the race condition. The attacker must craft network-based payloads or conditions that satisfy initial security checks while remaining exploitable after those checks complete. While not trivial to execute reliably, determined attackers with sufficient resources and target knowledge can achieve code execution. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog, suggesting active in-the-wild exploitation has not yet been widely documented, though this does not eliminate the risk.

Remediation

Users should install the latest available security update for Microsoft Edge on Android as released by Microsoft. Verify the patch version against Microsoft's official security advisories to confirm the specific build that addresses CVE-2026-58299. As an interim measure, users can reduce exposure by avoiding suspicious or untrusted links in email and messages that might be weaponized for delivery, and by considering alternative browsers if Edge updates are delayed. Organizations should inventory Android devices in use and ensure mobile device management (MDM) policies enforce automatic or timely Edge updates.

Patch guidance

Monitor Microsoft's official security advisories and the Microsoft Edge release notes for Android to identify the patch version that resolves CVE-2026-58299. Microsoft typically releases cumulative security updates monthly; verify the specific version number against the advisory before deployment. For organizations managing Android devices via MDM solutions (Intune, Samsung Knox, etc.), configure policies to automatically update Microsoft Edge to the patched version. Test patches on a representative set of Android devices before broad rollout to ensure compatibility with internal apps and workflows. Users on personal devices should enable automatic app updates in Google Play Store where possible.

Detection guidance

Detection of TOCTOU exploitation in Edge is challenging because the attack occurs within the browser process and may leave minimal forensic artifacts. Monitor for unexpected Edge crashes or restarts, which could indicate failed exploitation attempts. At the network level, look for suspicious patterns in traffic to Edge—such as unusual POST requests with malformed or oversized payloads that might probe for timing windows. On enrolled devices with MDM, ensure event logging for application crashes and OS-level security events is centralized. Behavioral indicators include unusual process creation or network connections spawned from Edge. However, definitive detection typically requires access to Edge's internal logs and memory forensics, which may not be practical at scale.

Why prioritize this

This vulnerability merits prioritization based on its HIGH CVSS severity, network attack vector, and the potential for complete code execution. While the requirement for user interaction and high attack complexity reduce the practical exploitation likelihood compared to unauthenticated remote code execution flaws, the mobile context (Android) means affected devices are often outside traditional network perimeters and may lack robust security monitoring. Microsoft Edge is a widely used browser on Android, increasing the potential impact scope. Organizations should prioritize patching within 30 days, with accelerated timelines for users handling sensitive data or those targeted by sophisticated threat actors.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: (1) Network attack vector (AV:N)—the flaw is reachable remotely; (2) High attack complexity (AC:H)—the TOCTOU race condition requires precise timing, limiting opportunistic exploitation; (3) No privileges required (PR:N)—an unauthenticated attacker can attempt the exploit; (4) Required user interaction (UI:R)—the user must perform an action (clicking a link, loading a page) that triggers the vulnerable code path; (5) Unchanged scope (S:U)—impact is confined to the Edge process; (6) High impact across all three pillars (C:H/I:H/A:H)—successful exploitation grants code execution with full browser process privileges. The score appropriately weights the high potential impact against the practical barriers to exploitation.

Frequently asked questions