EUVD-2026-52523
GHSA-78fm-87r7-5p5x
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Local-only exploitation with low privilege aligns with AV:L/PR:L; CWE-73 path control supports both C:H and I:H; no availability impact described.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
AnalysisAI
External file path control in Microsoft Edge for Android (versions below 151.0.4129.59) allows a local low-privileged attacker to disclose sensitive information stored on the device. Rooted in CWE-73, the flaw permits attacker-controlled input to dictate file name or path resolution within the browser, potentially exposing files outside the intended access scope. No public exploit identified at time of analysis, and SSVC confirms no known exploitation; however, the CVSS C:H and I:H ratings suggest the path control primitive may extend beyond read-only disclosure.
Technical ContextAI
CWE-73 (External Control of File Name or Path) describes a class of vulnerability where the software uses externally-controllable input to construct a file path without adequately restricting it to an intended directory. In the context of Microsoft Edge for Android (CPE: cpe:2.3:a:microsoft:microsoft_edge_for_android:*:*:*:*:*:*:*:*), this means that some component of the browser - likely handling file URIs, download paths, or local content - accepts user- or content-supplied path values and resolves them against the device filesystem without sufficient canonicalization or sandboxing enforcement. This could allow traversal outside the application's sandbox boundary on Android, exposing files readable by the browser process. The local attack vector (AV:L) confirms exploitation does not require network access; the attacker must have a presence on the device.
RemediationAI
Vendor-released patch: Microsoft Edge for Android 151.0.4129.59. Users should update to this version or later via the Google Play Store immediately. The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66310 provides official guidance. For environments where immediate update is not possible, consider restricting the browser's access to sensitive local file paths via Android enterprise MDM policy (e.g., disabling file:// URI access or enforcing app sandboxing controls through Intune or similar); note that MDM-level controls may reduce browser functionality for users who rely on local file access. Given the local attack vector, ensuring device-level access controls (screen lock, encryption, limiting physical access) also reduces exposure as a compensating measure.
More in Microsoft Edge For Android
View allUse-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execu
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop a
UI spoofing in Microsoft Edge for Android (versions below 148.0.3967.55) allows a remote, unauthenticated attacker with
Improper input validation in Edge for Android allows a remote attacker to tamper with data over a network by convincing
Spoofing in Microsoft Edge for Android versions below 148.0.3967.55 allows a network-based attacker to misrepresent crit
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today