Microsoft Edge for Android CVE-2026-66310

Exploitation requires local access to an Android device running Microsoft Edge for Android versions below 151.0.4129.59, with at minimum low-privilege (PR:L) access - consistent with a standard unprivileged app or user session on the device. No network access is required (AV:L confirmed). No user interaction is needed (UI:N). The vulnerability is specific to the Android platform; desktop or iOS variants of Edge are not listed as affected. The primary limiting factor is the local attack vector: an attacker must already have a foothold on the target device, either through physical access, a co-installed malicious application, or an existing compromise. Non-default configurations are not mentioned as a prerequisite - the flaw appears present in standard Edge for Android deployments within the affected version range.

The NVD-assigned CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects high confidentiality and integrity impact, but the local-only attack vector substantially constrains real-world risk. EPSS is 0.40% (33rd percentile), indicating very low exploitation probability relative to the broader CVE population. SSVC corroborates this: exploitation is assessed as 'none', the attack is not automatable, and technical impact is rated 'partial'. Taken together, these signals suggest this is a locally exploitable flaw requiring an attacker to already have low-privilege access to the target Android device - a meaningful pre-condition that limits opportunistic mass exploitation. The I:H rating in the CVSS vector warrants attention: it implies potential write capability beyond mere disclosure, though the CVE description is limited to information disclosure - verify with the vendor advisory whether integrity impact is confirmed or conservative. This is a genuine high-CVSS-but-constrained-real-risk scenario; prioritization should reflect the need for local device access.

An attacker with low-privilege local access to an Android device running a vulnerable version of Microsoft Edge for Android - for example, a malicious app or a co-tenant on a shared device - supplies a crafted file path to a browser component that resolves it without proper restriction, causing Edge to read (and potentially write) files outside its intended scope. No public exploit identified at time of analysis, so exploitation likely requires manual effort or a device-resident malicious payload. The low attack complexity (AC:L) suggests no race conditions or special timing are needed once local access is established.