What is the CVSS score of CVE-2026-58300?

CVE-2026-58300 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-58300?

Yes, a patch is available for CVE-2026-58300. Update the affected software to the latest version immediately.

Microsoft Edge Android CVE-2026-58300

EUVD-2026-41595 MEDIUM

Absolute Path Traversal (CWE-36)

2026-07-03 microsoft

GHSA-h677-5v32-7m48

Path Traversal Microsoft Google Microsoft Edge Chromium Based

5.5

CVSS 3.1 · NVD

Temporal: 5.4

Severity by source

Vendor (microsoft) PRIMARY

MEDIUM

qualitative

NVD

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CIRCL (temporal)

5.4 MEDIUM

cvss

vuln.today AI

6.2 MEDIUM

Local vector confirmed by description; no privileges or interaction required; impact is purely confidentiality loss with no integrity or availability effect.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jul 07, 2026 - 22:52 NVD

6.2 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 03, 2026 - 22:09 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

MEDIUM 6.2

DescriptionNVD

Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.

AnalysisAI

Absolute path traversal in Microsoft Edge for Android (Chromium-based) prior to version 150.0.4078.48 enables local, unauthenticated information disclosure by allowing crafted paths to escape the application's intended directory scope. The CVSS vector (AV:L/C:H/I:N/A:N) confirms the impact is limited to confidentiality loss on the local device, with no integrity or availability consequences. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

CWE-36 (Absolute Path Traversal) describes a failure to sanitize user-supplied file paths before resolving them, allowing an attacker to specify absolute filesystem paths that escape the intended directory boundary. In the context of Microsoft Edge for Android (CPE: cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*), this means a crafted input could cause the browser to resolve and expose files outside its sandboxed application storage. The Chromium-based architecture of Edge on Android means the vulnerability resides in Microsoft's Android-specific implementation layer rather than the shared Chromium rendering engine. Affected versions span from 1.0.0.0 up to but not including 150.0.4078.48.

RemediationAI

The primary fix is to update Microsoft Edge for Android to version 150.0.4078.48 or later via the Google Play Store or your organization's mobile device management (MDM) distribution channel. The Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58300 confirms patch availability. As a compensating control where immediate patching is not possible, organizations managing Android devices through MDM (e.g., Microsoft Intune) should consider restricting Edge's access to sensitive filesystem paths via app configuration policies, or temporarily enforcing an alternative approved browser. Restricting physical device access and enforcing full-disk encryption limits the blast radius of local information disclosure, though these do not remediate the underlying flaw. Note that disabling Edge entirely may disrupt workflows dependent on Edge-specific enterprise features such as SSO integration with Azure AD.