Microsoft Edge Android CVE-2026-58300

Exploitation requires local access to the Android device (AV:L), meaning the attacker must have physical possession of the device, ADB access, or the ability to interact with the device's local environment through another installed application. No application-level privileges within Edge are required (PR:N), and no user interaction is necessary (UI:N), meaning the traversal can be triggered without the victim taking any action once the attacker has local access. The vulnerability is limited to the confidentiality dimension - an attacker can read files but cannot write or modify them (I:N, A:N). Exploitation is further bounded by Android's application sandbox: only files accessible to the Edge process (its own data directory and any world-readable files) are candidates for disclosure. Versions 150.0.4078.48 and later are not affected.

The CVSS 6.2 score with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects a medium-severity vulnerability whose primary constraint is the local attack vector - exploitation requires the attacker to already have some form of local device access. While PR:N indicates no application-level privileges are required, the AV:L gate significantly limits the exposure surface compared to network-exploitable flaws. No EPSS data was provided; without it, probability of exploitation cannot be quantified. The absence of a CISA KEV listing and any reported POC further reduces urgency. The real-world risk is highest in scenarios involving shared or compromised Android devices, malicious co-located applications with inter-process file access, or physical device theft - less relevant to network-perimeter-focused threat models. Impact is high on confidentiality, making it relevant where Edge stores sensitive browser artifacts such as saved credentials, cookies, or cached content accessible to the traversal path.

An attacker with local access to an Android device - whether through physical possession, a malicious co-located app with overlapping file permissions, or compromised ADB access - provides a crafted absolute path input to a vulnerable Edge component, causing it to read and return a file outside its sandboxed storage directory. This could expose sensitive browser artifacts such as saved login credentials, session cookies, browsing history, or cached content stored by the Edge application. No POC has been publicly identified, but the low attack complexity (AC:L) suggests the technique requires minimal sophistication once local access is established.