Microsoft Edge Android EUVD-2026-41653

Exploitation requires that the victim is using Microsoft Edge (Chromium-based) on an Android device and must perform an active interaction - such as clicking a malicious link or navigating to an attacker-controlled page (UI:R confirmed by CVSS vector). The attacker requires no authentication and no elevated privileges (PR:N), and the attack can be initiated over a standard network connection (AV:N). The specific security feature being bypassed is not named in available data, which limits precise condition scoping; it is inferred from CWE-284 and CVSS C:H that the bypass allows access to data that should be restricted by a browser-enforced security boundary. Exploitation is limited to the Android platform - desktop or iOS Edge versions are not implicated by the CPE or description. The UI:R requirement prevents fully automated, zero-interaction mass exploitation.

The CVSS base score of 6.5 (Medium) is supported by a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating a network-reachable, low-complexity, unauthenticated attack that requires user interaction and yields high confidentiality exposure. The temporal modifiers E:U (exploit code unconfirmed or unavailable), RL:O (official remediation available), and RC:C (vulnerability confirmed by vendor) collectively reduce real-world urgency: no weaponized exploit is known, and a patch is in hand. EPSS data was not provided, and the CVE is not listed in CISA KEV, corroborating the low active exploitation signal. The practical risk is moderate: the C:H impact is meaningful for users whose sensitive data could be accessed, but the UI:R requirement limits mass automated exploitation. Organizations with Edge for Android deployed on managed mobile devices should prioritize patching within a normal patch cycle rather than emergency response.

An attacker hosts a malicious web page or crafted content that triggers the access control flaw when visited by a target using Microsoft Edge on Android. When the victim clicks a link or navigates to the attacker-controlled resource (satisfying UI:R), the security feature bypass is triggered and the attacker gains unauthorized access to high-confidentiality data accessible within the browser's security context. No public proof-of-concept exploit code has been identified at time of analysis.