CVE-2026-58300: Microsoft Edge Android Path Traversal Information Disclosure

Technical summary

CVE-2026-58300 is an absolute path traversal vulnerability (CWE-36) in Microsoft Edge for Android. The flaw permits unauthorized local information disclosure through improper handling of file path inputs. The vulnerability is mapped CVSS 3.1 score 6.2 (Medium severity) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating local attack vector, low attack complexity, no privilege requirement, no user interaction needed, unchanged scope, high confidentiality impact, and no integrity or availability impact. The vulnerability does not modify or delete data, only exposes it.

Business impact

While the vulnerability requires local access to exploit, it poses a direct risk to sensitive user data stored on Android devices. Organizations with mobile workforce policies allowing Edge on Android should consider the exposure of cached credentials, browsing history, local application data, or other confidential information stored on employee devices. The lack of required privileges or user interaction means any local compromise—whether through malware, shared device, or physical access—can lead to immediate data leakage. For BYOD or shared device environments, this is a notable concern.

Affected systems

Microsoft Edge for Android is directly affected. The vulnerability also involves the Android platform itself (Google Android), as the issue relates to how the operating system permits access to the filesystem. Organizations should check Edge version history in their mobile device management (MDM) records to identify affected devices. Verify against Microsoft's security advisory for the specific affected build range.

Exploitability

Exploitation requires local access to the Android device; remote exploitation is not possible. The attack has low complexity and does not need user interaction or elevated privileges, meaning any process or application running on the device could potentially trigger the vulnerability. This makes it particularly concerning when combined with other local vulnerabilities or in scenarios where a device is compromised or physically accessible. The vulnerability is not known to be actively exploited in public campaigns at this time.

Remediation

Users and administrators should update Microsoft Edge for Android to the latest available version that patches CVE-2026-58300. Check Microsoft's security update portal and your device manufacturer's release notes for the specific patched version. Organizations managing Android devices through MDM solutions should deploy the patch through their management console to enforce compliance.

Patch guidance

Verify the patched Edge version against Microsoft's official security advisory for CVE-2026-58300. Apply the patch via the Google Play Store to consumer devices or through your MDM platform for managed deployments. Test the update in a non-production environment if feasible to confirm compatibility with business applications. Prioritize devices in high-risk roles (e.g., those accessing sensitive corporate data) or high-traffic environments (e.g., shared devices).

Detection guidance

Monitor Edge version numbers across your mobile device fleet using MDM telemetry. Look for any suspicious file access patterns on Android devices from Edge processes, particularly access to system or application directories outside Edge's normal sandbox. If forensic analysis is warranted, examine Edge's process logs and filesystem access events for evidence of path traversal attempts. Alert on devices running unpatched versions of Edge identified through vulnerability scanning.

Why prioritize this

Medium severity (CVSS 6.2) with high confidentiality impact warrants timely patching, but the local-only attack vector lowers urgency compared to network-exploitable vulnerabilities. Organizations should prioritize this patch for devices handling sensitive data or in environments with higher physical security risk. The lack of known active exploitation also reduces immediate pressure, though the attack surface remains open until patched.

Risk score, explained

The CVSS 3.1 score of 6.2 reflects high confidentiality impact balanced against the requirement for local access. No privilege escalation is needed, and attack complexity is low, making exploitation straightforward once local access is obtained. The vulnerability does not enable code execution, lateral movement, or system instability—only data disclosure—which caps the severity at Medium. Organizations with strong endpoint security and physical controls may assess risk lower; those with weaker device hygiene or shared device models should assess higher.

Frequently asked questions