EUVD-2026-41593
GHSA-pp6w-gfj2-hq6c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Network-delivered malicious content with no privileges but requiring victim interaction (UI:R); high confidentiality loss of personal data, minor integrity effect, no availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in Microsoft Edge for Android (Chromium-based) allows a network-based attacker to expose a victim's private personal information, but only after luring the user into interacting with attacker-controlled content (UI:R). The flaw carries a CVSS 7.1 rating driven by high confidentiality impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. A vendor patch is available via Microsoft's MSRC update guide.
Technical ContextAI
The affected component is the Microsoft Edge browser for Android, which is built on the Chromium engine (the CPE identifies microsoft:microsoft_edge_(chromium-based)). The root cause is classified as CWE-359, Exposure of Private Personal Information to an Unauthorized Actor - a class of weakness where an application improperly handles or leaks personally identifiable or sensitive user data to a party that should not have access. In a browser context this typically stems from cross-origin data leakage, improper isolation of stored user data, or content that can read privileged information it should not, allowing that data to be exfiltrated over the network to an unauthorized actor.
RemediationAI
Patch available per vendor advisory: update Microsoft Edge for Android to the latest version distributed through the Google Play Store, and consult Microsoft's official advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58297 for the exact fixed build. As a compensating control until updating, avoid opening untrusted or unsolicited links in Edge on Android and enable automatic app updates in the Play Store so the fixed build is applied promptly; the trade-off is that automatic updates may briefly interrupt the app. Enterprise environments can enforce minimum-version compliance through mobile device management (MDM) to block outdated Edge installs, at the cost of additional policy administration.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today