What is the CVSS score of CVE-2026-58523?

CVE-2026-58523 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.5%.

Is there a patch available for CVE-2026-58523?

Yes, a patch is available for CVE-2026-58523. Update the affected software to the latest version immediately.

Microsoft Edge Android CVE-2026-58523

EUVD-2026-41653 MEDIUM

Improper Access Control (CWE-284)

2026-07-03 microsoft

GHSA-49m2-v6xm-3fhr

Authentication Bypass Google Microsoft Microsoft Edge Chromium Based

6.5

CVSS 3.1 · NVD

Temporal: 5.7

Severity by source

Vendor (microsoft) PRIMARY

MEDIUM

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CIRCL (temporal)

5.7 MEDIUM

cvss

vuln.today AI

6.5 MEDIUM

Network-delivered browser attack requires user click (UI:R); no credentials needed; bypass yields confidentiality loss only, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 22:20 vuln.today

CVE Published

Jul 03, 2026 - 21:26 cve.org

MEDIUM 6.5

DescriptionNVD

Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.

AnalysisAI

Security feature bypass in Microsoft Edge for Android exposes high-confidentiality data to unauthenticated network attackers who can induce user interaction. The vulnerability stems from improper access control (CWE-284) in the Chromium-based mobile browser, allowing an attacker to circumvent a security boundary and access protected information without credentials. No active exploitation is confirmed (CISA KEV absent, temporal metric E:U), and a vendor patch is available via MSRC, making this a patch-priority item rather than an emergency response.

Technical ContextAI

The affected product is Microsoft Edge for Android in its Chromium-based variant, identified by CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*, indicating all versions of the Chromium-based Edge are in scope. The root cause is CWE-284 (Improper Access Control), a class of flaw where security boundaries or permission checks are insufficiently enforced - in this context, a feature meant to prevent unauthorized access to sensitive data or browser security zones fails to correctly validate the legitimacy of a request or context. The 'Google' tag in the metadata suggests the underlying Chromium rendering engine may be implicated, as Edge on Android shares the Blink/V8 stack with Chrome. The network attack vector and confidentiality-only impact (C:H/I:N/A:N) are consistent with a same-origin policy bypass, cross-origin data leakage, or authentication bypass within the browser security model.

RemediationAI

Apply the vendor-released patch for Microsoft Edge for Android as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58523. Users on Android should update Edge via the Google Play Store to the latest available version; the exact patched version number is not enumerated in the available data and should be confirmed via the MSRC advisory. As a compensating control pending update, organizations managing mobile devices through an MDM/UEM solution can restrict or block Edge for Android access to sensitive internal resources until patching is confirmed. Disabling the specific security feature involved may reduce attack surface but could also impact usability; this trade-off should be evaluated against the MSRC guidance. No workaround replacing the patch has been identified from available data.