Microsoft Edge For Android
Monthly
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execution with scope change across all supported platforms including Windows, Linux, macOS, Android, and iOS. The vulnerability carries a CVSS 8.5 with high complexity and scope change (S:C), indicating that successful exploitation escapes the browser's sandboxing boundary and affects the underlying host. No public exploit or CISA KEV listing is present at time of analysis, though patch-available status from Microsoft confirms vendor acknowledgment.
External file path control in Microsoft Edge for Android (versions below 151.0.4129.59) allows a local low-privileged attacker to disclose sensitive information stored on the device. Rooted in CWE-73, the flaw permits attacker-controlled input to dictate file name or path resolution within the browser, potentially exposing files outside the intended access scope. No public exploit identified at time of analysis, and SSVC confirms no known exploitation; however, the CVSS C:H and I:H ratings suggest the path control primitive may extend beyond read-only disclosure.
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop applications that allows remote attackers to disclose sensitive information through crafted AI prompts. The vulnerability affects numerous Microsoft products across iOS, Android, and macOS platforms, requires user interaction, and has a patch available from Microsoft with no current evidence of active exploitation (not in KEV).
Improper input validation in Edge for Android allows a remote attacker to tamper with data over a network by convincing a user to interact with malicious content. Exploitation requires user interaction and results in low confidentiality and integrity impact, with no availability loss. No public exploit or active exploitation is known; an official vendor patch is available.
Spoofing in Microsoft Edge for Android versions below 148.0.3967.55 allows a network-based attacker to misrepresent critical security UI elements - such as page origin indicators or certificate status - to users who interact with attacker-controlled content, classified under CWE-451 (User Interface Misrepresentation of Critical Information). Impact is limited to confidentiality (C:L) with no integrity or availability consequences per the CVSS vector, and exploitation requires user interaction (UI:R). With EPSS at 0.06% (18th percentile), SSVC exploitation status of none, and no CISA KEV listing, real-world exploitation risk is low despite the network-accessible, unauthenticated attack vector.
UI spoofing in Microsoft Edge for Android (versions below 148.0.3967.55) allows a remote, unauthenticated attacker with high attack complexity to misrepresent critical browser security information to victims over a network, potentially deceiving users about the true origin or security state of web content. The flaw stems from CWE-451, where the browser fails to correctly display security-critical UI elements such as address bar content or trust indicators, enabling phishing or credential theft scenarios. No public exploit code has been identified, EPSS probability sits at 0.05%, and CISA SSVC rates exploitation status as none - placing this as a moderate-priority patch rather than an urgent emergency.
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execution with scope change across all supported platforms including Windows, Linux, macOS, Android, and iOS. The vulnerability carries a CVSS 8.5 with high complexity and scope change (S:C), indicating that successful exploitation escapes the browser's sandboxing boundary and affects the underlying host. No public exploit or CISA KEV listing is present at time of analysis, though patch-available status from Microsoft confirms vendor acknowledgment.
External file path control in Microsoft Edge for Android (versions below 151.0.4129.59) allows a local low-privileged attacker to disclose sensitive information stored on the device. Rooted in CWE-73, the flaw permits attacker-controlled input to dictate file name or path resolution within the browser, potentially exposing files outside the intended access scope. No public exploit identified at time of analysis, and SSVC confirms no known exploitation; however, the CVSS C:H and I:H ratings suggest the path control primitive may extend beyond read-only disclosure.
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop applications that allows remote attackers to disclose sensitive information through crafted AI prompts. The vulnerability affects numerous Microsoft products across iOS, Android, and macOS platforms, requires user interaction, and has a patch available from Microsoft with no current evidence of active exploitation (not in KEV).
Improper input validation in Edge for Android allows a remote attacker to tamper with data over a network by convincing a user to interact with malicious content. Exploitation requires user interaction and results in low confidentiality and integrity impact, with no availability loss. No public exploit or active exploitation is known; an official vendor patch is available.
Spoofing in Microsoft Edge for Android versions below 148.0.3967.55 allows a network-based attacker to misrepresent critical security UI elements - such as page origin indicators or certificate status - to users who interact with attacker-controlled content, classified under CWE-451 (User Interface Misrepresentation of Critical Information). Impact is limited to confidentiality (C:L) with no integrity or availability consequences per the CVSS vector, and exploitation requires user interaction (UI:R). With EPSS at 0.06% (18th percentile), SSVC exploitation status of none, and no CISA KEV listing, real-world exploitation risk is low despite the network-accessible, unauthenticated attack vector.
UI spoofing in Microsoft Edge for Android (versions below 148.0.3967.55) allows a remote, unauthenticated attacker with high attack complexity to misrepresent critical browser security information to victims over a network, potentially deceiving users about the true origin or security state of web content. The flaw stems from CWE-451, where the browser fails to correctly display security-critical UI elements such as address bar content or trust indicators, enabling phishing or credential theft scenarios. No public exploit code has been identified, EPSS probability sits at 0.05%, and CISA SSVC rates exploitation status as none - placing this as a moderate-priority patch rather than an urgent emergency.