EUVD-2026-52529
GHSA-rmq3-jw86-cmwm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Network delivery via web content (AV:N), no attacker privileges needed (PR:N), user must open the link (UI:R), scope change to device file system (S:C), high confidentiality loss (C:H), no write or denial-of-service impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Microsoft Edge for Android exposes device file contents to remote attackers through an external file path control flaw (CWE-73), enabling information disclosure across a scope boundary. The CVSS vector (S:C, C:H) confirms the vulnerability crosses from the browser sandbox into the broader Android file system or other protected resources. No public exploit code exists and an official vendor fix is available; exploitation requires user interaction, making this a meaningful but not critical-priority risk for most deployments.
Technical ContextAI
CWE-73 (External Control of File Name or Path) describes a condition where attacker-controlled input is used to construct or influence file system paths without adequate validation. In the context of Microsoft Edge for Android (CPE: cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*), this likely manifests as the browser processing attacker-crafted URIs, intent data, or web content that directs Edge to resolve file paths pointing to local device storage or other protected file resources. The Chromium-based architecture underlying Edge is relevant because file URI handling and Android intent routing represent historically sensitive attack surfaces. The scope change (S:C) in the CVSS vector indicates the disclosure reaches resources outside the browser's own security context - consistent with accessing the Android file system beyond the browser's sandbox.
RemediationAI
The primary fix is to update Microsoft Edge for Android to the patched version released by Microsoft. The exact minimum safe version is not independently confirmed from the available data - consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65802 for the specific build number. On Android, updates are delivered through the Google Play Store; enterprise deployments should use Intune or a managed MDM policy to enforce the update. If immediate patching is not possible, a compensating control is to restrict Edge for Android from accessing local file URIs via managed browser policies (disabling file:// URI scheme support where supported by Edge enterprise policy) - note this may break workflows that rely on locally-cached or offline content. Avoiding use of Edge for Android to open links from untrusted sources or unsolicited messages reduces user-interaction-dependent exposure.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execu
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today