Microsoft Edge Android CVE-2026-65802

User interaction is required - the victim must actively open a malicious link or navigate to attacker-controlled web content using Microsoft Edge for Android (UI:R in CVSS vector). The attacker requires no privileges or authentication (PR:N). The vulnerability is network-reachable (AV:N), meaning the malicious content is delivered remotely rather than requiring local device access. Exploitation is limited by the Android platform requirement (only the Android variant is specified), the need for social engineering to trigger user interaction, and the browser's existing sandbox controls which bound what files are accessible. The exact configuration condition - whether any specific Edge feature, permission, or Android version is required - is not enumerated in the available advisory data and should be confirmed via the MSRC advisory.

The CVSS 3.1 base score of 7.4 is supported by a network attack vector, low complexity, no required privileges, required user interaction, scope change, and high confidentiality impact with no integrity or availability impact. The temporal modifiers (E:U - Unproven exploitability; RL:O - Official Fix; RC:C - Confirmed report) reduce effective risk: no public proof-of-concept or exploit code has been identified at time of analysis, and a vendor patch is available. EPSS data was not provided, so exploitation probability cannot be quantitatively assessed. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. The UI:R requirement limits mass exploitation - victims must be induced to navigate to attacker-controlled content. Overall, this is a genuine information disclosure risk warranting prompt patching, especially in enterprise environments where Edge for Android is managed via Intune or MDM, but it does not represent an imminent, unpatched zero-day scenario.

An attacker crafts a malicious web page or deep link that, when opened in Microsoft Edge for Android, supplies a controlled file path causing the browser to read a sensitive local file (such as a credential store, configuration file, or document) and transmit its contents back to the attacker's server. The victim is socially engineered into tapping the link via a phishing email, SMS, or messaging app. No exploit code is publicly known, but the low attack complexity (AC:L) means a functional exploit would require only standard web and URI crafting knowledge once the specific code path is identified.