What is the CVSS score of CVE-2026-58296?

CVE-2026-58296 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Edge are affected by CVE-2026-58296?

Microsoft Edge for Android users are exposed to a privacy breach via CVE-2026-58296, which allows remote attackers to exfiltrate personal information without authentication simply by luring users to…. A patch is available.

How to fix or mitigate CVE-2026-58296?

Within 24 hours: Conduct inventory of Microsoft Edge for Android usage across managed and BYOD devices via MDM, app store metrics, or security logs; alert users not to visit untrusted content pending patch. Within 7 days: Deploy the latest patched release of Microsoft Edge for Android per vendor advisory across all endpoints via MDM or app store; prioritize enterprise-managed devices. Within 30 days: Audit patch deployment success (target >95% coverage); review application and network access logs for any unauthorized data exfiltration on or before patch deployment date; conduct privacy impact assessment if organizational exposure is confirmed.

Microsoft Edge CVE-2026-58296

EUVD-2026-41592 HIGH

Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)

2026-07-03 microsoft

GHSA-vfc9-fgwm-8mwp

Information Disclosure Microsoft Google Microsoft Edge Chromium Based

7.1

CVSS 3.1 · Vendor: microsoft

Temporal: 6.2

Severity by source

Vendor (microsoft) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

CIRCL (temporal)

6.2 MEDIUM

cvss

vuln.today AI

7.1 HIGH

Network-delivered malicious content requires victim interaction (UI:R) but no auth (PR:N); discloses private data (C:H) with minor integrity effect and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:36 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 7.1

DescriptionCVE.org

Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.

AnalysisAI

Information disclosure in Microsoft Edge for Android allows a remote unauthenticated attacker to exfiltrate private personal information over the network when a victim interacts with attacker-controlled content. The flaw carries a CVSS 7.1 with high confidentiality impact and stems from private data being exposed to an unauthorized actor (CWE-359); Microsoft has released a fix. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is Microsoft Edge, the Chromium-based browser, specifically its Android build (the CPE resolves to cpe:2.3:a:microsoft:microsoft_edge_(chromium-based)). The root cause maps to CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor), a privacy-class weakness in which sensitive user data - such as browsing data, credentials, identifiers, or cached content - becomes reachable by a party that should not have access. In a mobile Chromium browser context this typically involves a rendering, origin-isolation, or data-handling path where content loaded across security boundaries can observe information belonging to another origin or the user. The 'Google' and 'Microsoft Edge Chromium Based' tags reinforce that the underlying engine is Chromium, so the defect likely lives in Edge-specific handling atop the shared Chromium codebase rather than a generic desktop path.

RemediationAI

Patch available per vendor advisory: update Microsoft Edge for Android to the latest version distributed through the Google Play Store, as directed by Microsoft's MSRC entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58296 (the provided data confirms a vendor patch is available but does not enumerate an exact fixed build number, so verify the version there before validating remediation). Because the browser auto-updates via Play, ensure managed and enterprise fleets have Play auto-update enabled or push the update through MDM. As an interim compensating control while patching, instruct users to avoid opening untrusted links in Edge on Android and to use a fully updated alternative browser for sensitive sessions; note the trade-off that switching browsers disrupts Edge sync and saved-credential workflows. There is no need to disable a specific feature since no non-default configuration is implicated.