CVE-2026-58523: Microsoft Edge Android Access Control Bypass – CVSS 6.5

Technical summary

CVE-2026-58523 is classified as an improper access control flaw (CWE-284) affecting Microsoft Edge for Android. The vulnerability has a CVSS 3.1 score of 6.5 (Medium severity) with a network attack vector, low attack complexity, and no privileges required. The flaw allows unauthenticated remote attackers to circumvent a security feature via network-based vectors, resulting in high confidentiality impact while maintaining integrity and availability. The vulnerability was published on July 3, 2026, and modified on July 7, 2026.

Business impact

This vulnerability poses a moderate but material risk to organizations with Android users who rely on Microsoft Edge for secure browsing. The primary business impact is confidential data exposure—users may be deceived into visiting attacker-controlled sites where sensitive information becomes accessible despite security controls. Organizations handling regulated data (HIPAA, PCI-DSS, GDPR) should assess whether Edge is used to access protected information. The requirement for user interaction somewhat limits attack scale, but social engineering and phishing campaigns could exploit this reliably.

Affected systems

Microsoft Edge for Android is the primary affected system. The vulnerability is specific to the Chromium-based Edge browser on Google Android devices. Desktop versions of Edge and other browsers are not impacted. Users running older versions of Edge for Android are at risk until patching is completed. Android version does not appear to be a limiting factor—the vulnerability stems from Edge's access control implementation rather than underlying OS features.

Exploitability

Exploitability is moderate. An attacker cannot directly trigger the vulnerability; user interaction is required, typically through a malicious link or site visit. However, attack complexity is low—the attacker does not need special privileges, credentials, or system-level access. The network-based attack vector means exploitation can occur remotely without proximity. Social engineering, phishing, or malvertising could reliably deliver attack payloads. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been documented at publication, though this does not guarantee zero-day status or imminent threat.

Remediation

Organizations should prioritize deploying security updates to Microsoft Edge for Android as soon as Microsoft releases patches. End users should enable automatic updates in the Google Play Store settings to ensure timely patch installation. Until patches are available, consider organizational guidance restricting use of Edge for Android to non-sensitive browsing or recommending alternative browsers (Chrome, Firefox) for access to confidential systems. Monitor Microsoft's security advisories for patch availability and exact affected version ranges.

Patch guidance

Verify the specific patch version and release timeline against Microsoft's official security advisory, as exact version numbers were not provided in this analysis. Users should check the Microsoft Edge update history in the Google Play Store to confirm patch deployment. Once Microsoft publishes details, IT teams should prepare a staged rollout to test patches on a subset of Android devices before broad deployment. Coordinate with mobile device management (MDM) solutions if your organization uses them to enforce automatic updates or restrict unpatched Edge usage.

Detection guidance

Monitor for exploitation attempts by logging network traffic to known attacker infrastructure or suspicious domains. On Android devices, enable verbose logging where supported by your mobile security tools. Look for unusual user behavior patterns: unexpected access to sensitive sites via Edge, authentication failures followed by successful access attempts, or session anomalies. Organizations using Mobile Threat Defense (MTD) solutions should verify that detection rules for access control bypasses in Edge are enabled. Network-level detection is challenging since the attack uses normal HTTPS traffic; focus on behavioral indicators and user-reported suspicious activity.

Why prioritize this

This vulnerability merits medium priority in most patch queues. The CVSS 6.5 (Medium) rating combined with the requirement for user interaction makes it less critical than remote code execution flaws, but the high confidentiality impact and ease of attack (low complexity, no authentication required) elevate it above routine updates. Organizations handling sensitive data on Android devices or where Edge is widely deployed should prioritize this patch within 2–4 weeks. Firms in regulated industries or with strict data protection requirements may want to expedite patching to the front of their Android update cycle.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a Medium-severity vulnerability with significant but not catastrophic risk. The network attack vector and low complexity indicate broad reachability and ease of exploitation. The absence of authentication requirements lowers the barrier to attack initiation. However, mandatory user interaction reduces the likelihood of large-scale automated exploitation. The high confidentiality impact (C:H) is the primary driver of the 6.5 score, while unchanged integrity (I:N) and availability (A:N) confirm that the attacker cannot alter data or cause denial of service. This risk profile is typical of access control and information disclosure vulnerabilities affecting mobile browsers.

Frequently asked questions