What is the CVSS score of CVE-2026-58299?

CVE-2026-58299 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Edge are affected by CVE-2026-58299?

Microsoft Edge for Android contains a remote code execution vulnerability (CVE-2026-58299) that allows unauthenticated attackers to compromise mobile devices when users interact with malicious…. A patch is available.

How to fix or mitigate CVE-2026-58299?

Within 24 hours: Inventory all organizational Android devices running Microsoft Edge and identify business-critical usage. Within 7 days: Deploy Microsoft Edge updates to all affected Android devices through mobile device management (MDM) or app store; verify devices reach the latest patched version. Within 30 days: Audit deployment logs to confirm universal patch coverage and establish monitoring for exploitation attempts.

Microsoft Edge CVE-2026-58299

EUVD-2026-41572 HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-07-03 microsoft

GHSA-g4pq-v493-r36h

Authentication Bypass Microsoft Google Microsoft Edge Chromium Based

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.5 MEDIUM

cvss

vuln.today AI

7.5 HIGH

Network-delivered and unauthenticated (AV:N/PR:N) but requires victim interaction (UI:R) and winning a non-deterministic race (AC:H); browser-context code execution yields full C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:22 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge for Android (Chromium-based) arises from a time-of-check to time-of-use (TOCTOU) race condition that an unauthenticated network attacker can win to run arbitrary code, though success requires the victim to interact (UI:R) and the timing window makes exploitation high-complexity. Microsoft (self-reported) has shipped an official fix, and the temporal signals (E:U, RC:C) indicate no public exploit identified at time of analysis despite confirmed technical validity. The flaw is credited to Microsoft/Google collaboration and tagged as an authentication-bypass-class issue.

Technical ContextAI

The root cause is CWE-367 (TOCTOU race condition): a security-relevant resource or state is validated at one moment (time-of-check) but used later (time-of-use), and a concurrent operation mutates that state in the intervening window so the used value differs from the checked one. In a Chromium-based browser such as Microsoft Edge, such races typically live in multi-threaded/multi-process handling of downloads, file/URL resolution, IPC, or navigation state, where a check on a benign object is bypassed and a malicious object is substituted before use. The affected CPE is cpe:2.3:a:microsoft:microsoft_edge_(chromium-based) and the description scopes the impact to the Android build of Edge, which shares the Chromium/Blink engine with the desktop product.

RemediationAI

Patch available per vendor advisory: update Microsoft Edge for Android to the fixed release referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58299 (an exact fixed version number is not included in the supplied data, so obtain it from that page or the Google Play listing). On Android, ensure Play Store auto-updates are enabled so the Edge app receives the patched Chromium build promptly. As interim compensating controls until the update is applied, users can avoid opening untrusted links in Edge and use an alternative patched browser for high-risk browsing; because UI:R is required, user-awareness and blocking untrusted content reduce exposure, with the trade-off of reduced convenience rather than any functional loss once the app is updated.