CVE-2024-29986 Overview
CVE-2024-29986 is an information disclosure vulnerability affecting Microsoft Edge for Android (Chromium-based). Microsoft published the advisory on April 18, 2024. The issue is tracked under CWE-359, which covers exposure of private personal information to unauthorized actors.
Exploitation requires user interaction over the network, and successful attacks can compromise the confidentiality and integrity of information handled by the mobile browser. The Exploit Prediction Scoring System (EPSS) currently rates the vulnerability at 0.514% with a percentile of approximately 42, indicating a low probability of near-term exploitation.
Critical Impact
An attacker can trick a user into interacting with crafted content in Microsoft Edge for Android, leading to unauthorized exposure of user information.
Affected Products
- Microsoft Edge (Chromium-based) for Android
- Google Android platform hosting vulnerable Edge builds
- Deployments of Microsoft Edge Chromium prior to the fixed release referenced in the Microsoft advisory
Discovery Timeline
- 2024-04-18 - CVE-2024-29986 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-29986
Vulnerability Analysis
CVE-2024-29986 is classified as an information disclosure flaw in Microsoft Edge for Android. The Microsoft advisory categorizes the weakness under CWE-359, exposure of private personal information to an unauthorized actor.
The attack path is network-based and requires the user to perform an action, such as visiting an attacker-controlled page or interacting with a crafted resource. No prior authentication is required. Successful exploitation can expose data that the browser normally protects, and it can influence integrity by altering how sensitive content is rendered or persisted on the device.
Microsoft has not released detailed technical internals for this issue. The vulnerability affects the Android build of Edge specifically, which suggests the defect resides in mobile-specific rendering, storage, or platform integration code rather than the shared Chromium desktop pipeline.
Root Cause
The root cause is improper handling of private information within Microsoft Edge for Android, allowing that data to reach an actor who should not receive it. Microsoft has not published the specific code path in the public advisory.
Attack Vector
The attack vector is network-based with user interaction required. An attacker delivers crafted web content or a malicious link that the target opens in Microsoft Edge on Android. Interacting with the content triggers the disclosure of information the browser would otherwise keep confined.
No verified proof-of-concept code is publicly available for CVE-2024-29986. Refer to the Microsoft Vulnerability Advisory for vendor-supplied technical guidance.
Detection Methods for CVE-2024-29986
Indicators of Compromise
- Unexpected outbound requests from Microsoft Edge on Android to unfamiliar domains shortly after users open external links
- Mobile threat defense alerts flagging phishing or malicious URL categories accessed through Edge
- User reports of session data, autofill content, or account identifiers appearing in unfamiliar contexts
Detection Strategies
- Inventory Microsoft Edge for Android versions across managed mobile devices and flag builds predating the vendor fix
- Correlate mobile browser telemetry with URL reputation feeds to identify interaction with suspicious pages
- Monitor mobile device management (MDM) compliance events for Edge update status drift
Monitoring Recommendations
- Enable MDM or unified endpoint management reporting for Microsoft Edge version compliance on Android
- Ingest mobile browsing and DNS telemetry into a centralized analytics platform for retroactive hunting
- Alert on repeated visits from corporate Android devices to newly registered or low-reputation domains
How to Mitigate CVE-2024-29986
Immediate Actions Required
- Update Microsoft Edge for Android to the patched version referenced in the Microsoft advisory
- Enforce automatic app updates for Microsoft Edge through Google Play managed configurations or MDM policy
- Communicate phishing risk to end users, since exploitation requires them to interact with attacker-supplied content
Patch Information
Microsoft addressed CVE-2024-29986 in an updated release of Microsoft Edge for Android. Administrators should consult the Microsoft Security Response Center advisory for the exact fixed version and apply it through Google Play or their mobile application management platform.
Workarounds
- Restrict use of Microsoft Edge on Android until the patched version is deployed, routing browsing through an alternative hardened browser
- Apply MDM policies that block installation of outdated Edge builds and require minimum version compliance
- Enable SmartScreen and enterprise URL filtering to reduce exposure to malicious pages that could trigger the disclosure
# Example: enforce minimum Microsoft Edge version via Android Enterprise managed configuration
# Set within your MDM console for the com.microsoft.emmx app
minimumRequiredVersion="<patched-version-from-msrc>"
autoUpdatePolicy="ALWAYS"
smartScreenEnabled=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
