Microsoft Edge Android EUVD-2026-41573

Exploitation requires a malicious application to be co-installed on the same Android device as a vulnerable version of Microsoft Edge (Chromium-based) prior to 150.0.4078.48. The CVSS vector (PR:N/UI:N/AC:L) indicates that neither special Android permissions nor any victim interaction is required after the malicious app is installed. The attack is bounded to local execution context (AV:L): remote network-based exploitation is not indicated. Exploitation is limited by the requirement for the attacker to have achieved local code execution or app installation on the target device, which typically requires either physical access, social engineering to install a trojanized app, or exploitation of a separate initial-access vulnerability.

The CVSS 3.1 base score of 6.8 (Medium) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N presents a nuanced risk picture. The local attack vector (AV:L) limits exposure to scenarios where a malicious application is already present on the device, significantly reducing the attacker population compared to network-exploitable flaws. However, the combination of no privileges required (PR:N), no user interaction (UI:N), and low complexity (AC:L) means that once a malicious app is installed, exploitation requires no further victim action and no special Android permissions - a relatively low bar in mobile threat models where side-loaded or trojanized apps are a realistic vector. The high confidentiality impact (C:H) is material: Edge on Android may store browsing history, cached credentials, session cookies, and downloaded files within its sandboxed storage that could be exfiltrated via traversal. The low integrity impact (I:L) is asserted by the vendor vector but not elaborated in the description - it is inferred rather than confirmed. EPSS data was not provided in the input; exploitation probability cannot be quantified beyond the CVSS signals. No KEV listing and no public POC have been identified, suggesting this is not currently being exploited at scale. Overall, this is a credible but bounded risk: real priority for organizations with managed Android fleets running Edge, lower urgency for consumer-only deployments unless threat model includes malicious app installation.

A threat actor publishes a malicious Android application to a third-party app store or distributes it via phishing. Once installed alongside Edge for Android on the victim's device, the malicious app sends a crafted request containing relative path sequences (e.g., '../../') to an Edge-exposed interface - such as a content provider or file URI handler - causing Edge to resolve and return file contents from outside its intended application sandbox. The attacker's app receives sensitive local data such as browsing cookies, cached credentials, or downloaded files without requiring any interaction from the device owner. No public proof-of-concept has been identified at time of analysis.