CVE-2026-58522: Microsoft Edge Android Path Traversal Vulnerability – MEDIUM Severity

Technical summary

CVE-2026-58522 is a relative path traversal vulnerability (CWE-23) in Microsoft Edge for Android. The vulnerability stems from insufficient path validation when handling file access requests. An attacker with local access can construct malicious relative paths containing directory traversal sequences to access files outside the intended scope. The CVSS 3.1 score of 6.8 (MEDIUM) reflects a local attack vector with no privilege requirement, resulting in high confidentiality impact and limited integrity impact, while availability is unaffected.

Business impact

This vulnerability primarily affects users of Microsoft Edge on Android devices. While exploitation requires local device access, a compromised or physically accessed device could be leveraged to extract sensitive user data—including cached credentials, browsing history, or application-stored secrets. For organizations managing Android devices in BYOD or enterprise scenarios, this represents a risk to data confidentiality, though the local-only attack surface limits broad external exploitation.

Affected systems

Microsoft Edge for Android (Chromium-based) is the confirmed affected product. The vulnerability also involves the Android operating system as the underlying platform. Organizations and individuals using Microsoft Edge as their primary browser on Android devices should assess their exposure. Desktop or iOS versions of Edge are not affected by this specific vulnerability.

Exploitability

Exploitation requires local access to an affected Android device—either physical possession or prior compromise. An attacker cannot exploit this remotely. No user interaction is needed once local access is established, and no special privileges are required on the device. This relatively low exploitability barrier makes it a concern for scenarios involving device theft, shared devices, or post-compromise lateral data exfiltration, but it does not represent a mass-exploitation risk.

Remediation

Microsoft will release a patched version of Edge for Android addressing this path traversal issue. Users should enable automatic updates or manually update Microsoft Edge through the Google Play Store to the latest available version when the patch becomes available. Verify the specific patched version number in Microsoft's official security advisory. For organization-managed devices, deploy the update through your mobile device management (MDM) solution.

Patch guidance

Monitor Microsoft's official security advisories and the Edge release notes for the patch version addressing CVE-2026-58522. Once released, prioritize deployment to all Android devices running affected versions of Edge. If your organization uses MDM or app management policies, configure automatic or forced updates for Microsoft Edge. Test the patched version in a limited pilot before broad rollout to ensure no compatibility issues with internal applications or workflows.

Detection guidance

Monitor for suspicious file access patterns on Android devices—particularly attempts to access files outside normal application directories using relative path constructs. Endpoint detection and response (EDR) tools with mobile agent support may flag unusual file system queries. Review access logs and audit trails on shared or high-risk devices. Note that this vulnerability leaves minimal forensic artifacts unless paired with data exfiltration; focus detection efforts on devices with elevated risk profiles or those that have been physically accessed.

Why prioritize this

Although scored MEDIUM severity, this vulnerability warrants prompt attention in organizations with significant Android deployment. The combination of high confidentiality impact and the absence of any required user interaction or elevated privileges makes it an attractive target for attackers with device access. Prioritize patching devices belonging to high-value users, administrators, or those handling sensitive data. For general user populations, treat it as part of routine mobile security update cycles.

Risk score, explained

The CVSS 3.1 score of 6.8 reflects the local attack vector (AV:L), low complexity (AC:L), no privilege requirement (PR:N), and no user interaction (UI:N). High confidentiality impact (C:H) elevates the score, while limited integrity impact (I:L) and no availability impact (A:N) prevent a higher rating. This is a solid MEDIUM score appropriately capturing the threat: serious for devices at risk of local compromise, but not critical given the local-only attack surface.

Frequently asked questions