Microsoft Edge CVE-2026-58299

Exploitation requires the victim to actively interact with attacker-supplied content in Microsoft Edge for Android (CVSS UI:R) - e.g., visiting a crafted page or opening malicious content - and requires the attacker to reliably win a time-of-check/time-of-use race window, which the CVSS AC:H rating flags as high-complexity and non-deterministic. No authentication or prior access is needed (PR:N), and the vector is network-delivered (AV:N). The principal limiting factors are the mandatory user interaction and the narrow, timing-dependent race window; there is no indication a special non-default Edge configuration is required, but the exact vulnerable versions are not pinned in the available data.

The CVSS 3.1 base of 7.5 (AV:N/AC:H/PR:N/UI:R) reflects a network-reachable, unauthenticated flaw with full C/I/A impact, but two factors materially lower real-world risk: AC:H (winning a race is non-deterministic and often unreliable) and UI:R (the victim must take an action, e.g., visit a page or open content). The temporal metrics reinforce a lower operational priority: E:U (exploit unproven - no public exploit identified at time of analysis), RL:O (official remediation available), and RC:C (confirmed). There is no CISA KEV listing and no POC signal, so this is confirmed-but-not-actively-exploited. Note a data tension to verify: the CPE string references generic Chromium-based Edge while the description specifies Edge for Android, and the 'Authentication Bypass' tag is not obviously reflected in the CVSS impact metrics - treat the Android scoping and the auth-bypass characterization as vendor-labeled and confirm against the MSRC advisory.

An attacker hosts a malicious web page and lures an Edge-for-Android user to visit it; while the browser validates a resource, the page's script rapidly mutates the underlying state to win the TOCTOU race, substituting attacker-controlled data before it is used and achieving code execution in the browser context. Because AC:H reflects the timing sensitivity, the attacker likely needs many attempts, and no public exploit has been identified at time of analysis.