Microsoft Edge CVE-2026-58296

Exploitation requires victim user interaction (CVSS UI:R) - the target must open or engage with attacker-controlled web content in Microsoft Edge on Android; it cannot be triggered fully passively. No authentication is required (PR:N) and no special or non-default configuration is indicated in the description, so a default installation of Edge for Android is vulnerable. The limiting factors are: the attack is confined to the Android platform build of Edge, not other platforms per the description; the mandatory user interaction, which constrains it to social-engineering or drive-by delivery rather than automated remote exploitation; and the impact is disclosure of private information only (C:H, I:L, A:N), not code execution or system compromise.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) indicates a network-reachable, low-complexity, unauthenticated attack that requires user interaction, with high confidentiality impact but only low integrity and no availability impact - consistent with an information-disclosure bug rather than code execution. The single required condition (UI:R) meaningfully limits mass exploitation: a victim must actively interact with malicious content, favoring phishing or drive-by patterns over wormable automation. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified, and no SSVC decision data was supplied. Critically, the CVE is not in CISA KEV and no POC is referenced, so this is a patch-worthy but not emergency-tier issue: a real priority for a widely deployed browser, but absent active exploitation or public exploit code the urgency is driven by ubiquity and ease of patching rather than confirmed in-the-wild abuse.

An attacker crafts a malicious web page or link and lures an Edge-for-Android user to open it (for example via phishing, a poisoned ad, or a messaging link). When the victim interacts with the page, the flaw exposes private personal information from the browser to the attacker over the network. No POC is publicly identified, and the low attack complexity means a working exploit, if developed, would be reliable to trigger.