CVE-2026-58297: Microsoft Edge Information Disclosure Flaw

CVE-2026-58297 Overview

CVE-2026-58297 is an information disclosure vulnerability in Microsoft Edge for Android. The flaw exposes private personal information to unauthorized actors, allowing a remote attacker to disclose sensitive data over a network. The vulnerability is categorized under [CWE-359] (Exposure of Private Personal Information to an Unauthorized Actor) and affects the Chromium-based Edge browser running on Android devices.

Exploitation requires user interaction, such as visiting a malicious page or interacting with attacker-controlled content. Successful exploitation leaks confidential user data without requiring authentication on the target device.

Critical Impact
Remote attackers can disclose private personal information from Microsoft Edge for Android users over a network when the victim interacts with malicious content.

Affected Products

Microsoft Edge (Chromium-based) for Android
Google Android platform hosting the vulnerable Edge build
Browser sessions where users interact with attacker-controlled web content

Discovery Timeline

2026-07-03 - CVE-2026-58297 published to the National Vulnerability Database
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-58297

Vulnerability Analysis

The vulnerability resides in Microsoft Edge for Android, the Chromium-based mobile browser. It falls under [CWE-359], which covers the exposure of private personal information to actors who should not have access to that data. The issue permits an unauthorized attacker to retrieve sensitive user information across a network boundary.

The attack path is network-based and requires the victim to perform an action, such as clicking a link, loading a crafted web page, or interacting with a malicious element in the browser. Confidentiality impact is high, while integrity impact is limited and availability is not affected. No privileges are required on the target device to launch the attack.

The EPSS score is 0.309%, placing this vulnerability in the 22.7 percentile for likelihood of exploitation activity in the near term.

Root Cause

The root cause is improper handling of private personal information within the Edge for Android browser. Data that should remain isolated to the user session becomes accessible to unauthorized parties through the network. Microsoft has not published detailed technical internals of the flaw beyond the advisory.

Attack Vector

An attacker hosts crafted content and lures a victim using Edge for Android to interact with it. Once the user engages with the content, the browser leaks private data over the network to the attacker. No local access, no elevated privileges, and no prior authentication are needed. The single required precondition is user interaction with the malicious resource.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-58297

Indicators of Compromise

Outbound HTTPS or HTTP requests from Edge for Android to unrecognized domains carrying user-identifiable parameters or headers
Anomalous browser telemetry events tied to specific crafted URLs shared through phishing, SMS, or messaging apps
Access logs on corporate proxies showing Edge Android user agents contacting low-reputation hosts shortly after link clicks

Detection Strategies

Inspect mobile proxy and DNS logs for connections initiated by com.microsoft.emmx (Edge for Android package) to suspicious destinations
Correlate messaging or email delivery events with subsequent Edge browsing sessions that transmit unusual payload sizes
Deploy mobile threat defense agents that can flag data exfiltration patterns from browser processes

Monitoring Recommendations

Enable network-layer inspection for managed Android endpoints where feasible, with policy exceptions for personal data
Track Edge for Android version strings reported through mobile device management (MDM) inventory to identify unpatched builds
Alert on high-risk URL categories accessed via Edge for Android from corporate-managed devices

How to Mitigate CVE-2026-58297

Immediate Actions Required

Update Microsoft Edge for Android to the fixed version distributed through the Google Play Store as referenced in the Microsoft advisory
Enforce automatic app updates on managed Android devices through MDM or enterprise mobility management policies
Warn users against clicking untrusted links opened in Edge for Android until patch deployment is confirmed

Patch Information

Microsoft has released guidance and a fixed build for Edge for Android. Refer to the Microsoft CVE-2026-58297 Update Guide for the specific fixed version and rollout details. Confirm the installed version through the Play Store or through your MDM inventory before closing remediation tickets.

Workarounds

Restrict use of Edge for Android on managed devices until the update is applied, routing users to an alternate patched browser
Apply URL filtering at the corporate mobile gateway or via secure web gateway to block known malicious domains that could trigger the flaw
Educate users to avoid interacting with unsolicited links in email, SMS, and messaging apps while Edge remains unpatched

bash

# Example: query MDM inventory for Edge for Android versions
# (adjust command to your MDM platform's CLI or API)
mdm-cli app-inventory \
  --package com.microsoft.emmx \
  --fields deviceId,appVersion,lastCheckIn \
  --output edge-android-versions.csv