EUVD-2026-41573
GHSA-v5h7-6v7v-x933
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack vector consistent with Android co-app exploitation; PR:N because no special Android permissions required per description and vendor vector; I:L retained per vendor but not independently verifiable from description alone.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
AnalysisAI
Relative path traversal in Microsoft Edge for Android (Chromium-based) before version 150.0.4078.48 permits a local, unprivileged attacker to read sensitive files outside the application's intended directory scope, achieving high confidentiality impact with minor integrity exposure. The flaw (CWE-23) stems from insufficient sanitization of relative path sequences in Edge's Android file-handling logic. No public exploit code or active exploitation has been identified at time of analysis, though a vendor patch is available and should be prioritized given the high confidentiality impact rating.
Technical ContextAI
CWE-23 (Relative Path Traversal) occurs when an application constructs file system paths from user-controlled or externally influenced input without stripping or neutralizing relative path components such as '../'. On Android, this class of vulnerability frequently manifests in exported Content Providers, WebView file access configurations, or IPC mechanisms that resolve file URIs without canonical path enforcement. The affected product per CPE is cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*, covering all Chromium-based Edge builds below 150.0.4078.48 on Android. Because the CVSS vector specifies AV:L/PR:N, the attack surface is consistent with a co-installed malicious Android application exploiting an unprotected or inadequately guarded Edge file-access interface without requiring any special system permissions.
RemediationAI
The primary fix is to update Microsoft Edge for Android to version 150.0.4078.48 or later, available through the Google Play Store or via managed MDM distribution channels. The vendor advisory is published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58522. Organizations managing Android devices via MDM (Intune, Jamf, etc.) should push the Edge update as a required application update and verify compliance through device inventory. As a compensating control where immediate patching is not feasible, consider restricting sideloading of untrusted applications via Android Enterprise policy (disabling 'Install Unknown Apps'), which reduces the realistic attacker pre-position of a co-installed malicious app required to exploit the AV:L vector - note this does not eliminate risk from apps distributed via Play Store. Revoking or restricting Edge's access to broad external storage permissions via per-app permission management may also limit the impact of traversal if such permissions are granted.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today