EUVD-2026-41593
GHSA-pp6w-gfj2-hq6c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious web page
-
DeliveryLure victim to open link in Edge
-
ExploitVictim interacts with page
-
ExecutionTrigger private-data exposure
-
ImpactExfiltrate personal information over network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection PII protection
|
| Exploitation Conditions | Exploitation requires the victim to actively interact with attacker-controlled web content in Microsoft Edge on Android - per the CVSS vector's UI:R, the attack cannot proceed without user interaction (e.g., visiting a malicious link or engaging with a crafted page). No authentication or prior privileges are needed (PR:N), and the attack is network-delivered against default Edge installations. The principal limiting factors are the mandatory user interaction and the platform constraint: the confirmed affected platform is the Android build of Edge, so desktop and other platform users are not indicated as affected by this description. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) indicates a network-reachable, low-complexity attack requiring no privileges but requiring user interaction, with high confidentiality impact and only low integrity impact. The user-interaction requirement (UI:R) is the primary limiting factor - the attacker cannot succeed silently and must convince the victim to open or interact with malicious web content. No EPSS score was provided in the input, and the vulnerability is not in CISA KEV, so there is no signal of active exploitation; likewise no POC is referenced, so this is not a widely-weaponized issue. Overall this is a real but moderate-priority browser confidentiality bug: meaningful because it exposes private personal data at scale-capable network vector, but tempered by the required user interaction and the absence of any exploitation or POC evidence. Note the CPE lists the generic Chromium-based Edge product while the description specifies the Android platform - treat Android as the confirmed affected platform. |
| Exploit ScenarioDerived | An attacker hosts a malicious or booby-trapped web page and uses phishing, a malicious ad, or a crafted link to get an Edge-for-Android user to open it. When the victim interacts with the page, the flaw causes the browser to leak the victim's private personal information back to the attacker over the network. No public exploit code is currently identified, and the required user interaction lowers the odds of mass, unattended exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 03, 2026
Information disclosure in Microsoft Edge for Android (Chromium-based) allows a network-based attacker to expose a victim's private personal information, but only after luring the user into interacting with attacker-controlled content (UI:R). The flaw carries a CVSS 7.1 rating driven by high confidentiality impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. A vendor patch is available via Microsoft's MSRC update guide.
RemediationAI
Patch available per vendor advisory: update Microsoft Edge for Android to the latest version distributed through the Google Play Store, and consult Microsoft's official advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58297 for the exact fixed build. As a compensating control until updating, avoid opening untrusted or unsolicited links in Edge on Android and enable automatic app updates in the Play Store so the fixed build is applied promptly; the trade-off is that automatic updates may briefly interrupt the app. Enterprise environments can enforce minimum-version compliance through mobile device management (MDM) to block outdated Edge installs, at the cost of additional policy administration.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Microsoft Edge browser for Android, which is built on the Chromium engine (the CPE identifies microsoft:microsoft_edge_(chromium-based)). The root cause is classified as CWE-359, Exposure of Private Personal Information to an Unauthorized Actor - a class of weakness where an application improperly handles or leaks personally identifiable or sensitive user data to a party that should not have access. In a browser context this typically stems from cross-origin data leakage, improper isolation of stored user data, or content that can read privileged information it should not, allowing that data to be exfiltrated over the network to an unauthorized actor.
Know when Microsoft Edge Chromium Based gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Network-delivered malicious content with no privileges but requiring victim interaction (UI:R); high confidentiality loss of personal data, minor integrity effect, no availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
DescriptionNVD
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.
Executive ViewAI
Microsoft Edge for Android users face an information disclosure vulnerability (CVE-2026-58297) that exposes personal data when they interact with attacker-controlled content. While no active exploitation has been documented and a vendor patch is available, the confidentiality exposure poses data privacy and regulatory compliance risks for organizations managing Android devices.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) lets an attacker run arbitrary code in the browser by getting a
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Use-after-free memory corruption in Microsoft Edge (Chromium-based) can let remote attackers execute arbitrary code in t
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Exploit-DB