CVE-2026-58299 Overview
CVE-2026-58299 is a Time-of-Check Time-of-Use (TOCTOU) race condition affecting Microsoft Edge for Android. The flaw allows an unauthorized remote attacker to execute code over a network when a user is enticed into interacting with malicious content. The vulnerability is classified under [CWE-367] and carries a CVSS v3.1 base score of 7.5. Successful exploitation impacts confidentiality, integrity, and availability of the affected browser process on the Android device. Microsoft published guidance through the Microsoft Security Update CVE-2026-58299 advisory.
Critical Impact
Remote code execution in the context of the browser process on Android devices running vulnerable Microsoft Edge builds, enabling data theft and further device compromise.
Affected Products
- Microsoft Edge (Chromium-based) for Android
- Google Android platform hosting vulnerable Edge builds
- Any mobile deployment relying on Microsoft Edge Chromium as the default browser
Discovery Timeline
- 2026-07-03 - CVE-2026-58299 published to the National Vulnerability Database
- 2026-07-07 - Last updated in the NVD database
Technical Details for CVE-2026-58299
Vulnerability Analysis
The vulnerability is a TOCTOU race condition in Microsoft Edge for Android. TOCTOU flaws occur when the state of a resource changes between the moment it is validated and the moment it is used. In this case, the browser checks a security-relevant condition, then acts on the resource after an attacker has manipulated its state. Because Edge is Chromium-based, the affected code path likely intersects browser resource loading, file access, or IPC handling on the Android runtime. An attacker exploits this window to bypass the intended security check and trigger code execution within the browser process.
Exploitation requires user interaction, such as visiting an attacker-controlled web page. The attack complexity is high because the adversary must reliably win the race condition on the target device. Given the mobile execution context, successful exploitation can expose stored credentials, session cookies, and cached browsing data. The EPSS probability at time of publication is 0.27%, reflecting no observed in-the-wild exploitation.
Root Cause
The root cause is non-atomic handling of a resource in Microsoft Edge Chromium on Android [CWE-367]. Security-relevant validation and the subsequent use of the validated resource are separated by a time window an attacker can influence. Under specific timing conditions, the resource state changes after validation but before use, invalidating the security check.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts crafted web content that triggers the race condition when the victim navigates to the page in Microsoft Edge for Android. Successful exploitation yields code execution in the browser process, which can be chained with sandbox escapes or Android privilege bugs for broader device compromise.
No public proof-of-concept code has been published for this issue. Refer to the Microsoft Security Update CVE-2026-58299 advisory for vendor-specific technical detail.
Detection Methods for CVE-2026-58299
Indicators of Compromise
- Unexpected child processes spawned by the Microsoft Edge Android package (com.microsoft.emmx)
- Outbound connections from mobile devices to unfamiliar domains immediately after browser navigation events
- Anomalous file writes within the Edge application sandbox on Android devices
- Crash reports or WebView exceptions clustered around specific URLs across multiple users
Detection Strategies
- Inventory installed Microsoft Edge versions on Android endpoints and flag builds prior to the fixed release referenced in the MSRC advisory
- Correlate mobile browser telemetry with proxy or DNS logs to identify visits to known malicious URLs targeting Edge on Android
- Monitor mobile threat defense (MTD) alerts for suspicious browser behavior, code injection, or unexpected native library loads
Monitoring Recommendations
- Ingest Android mobile device management (MDM) and MTD logs into a centralized analytics platform for correlation with threat intelligence
- Alert on Edge for Android crash telemetry that references memory corruption or race condition signatures
- Track URL reputation feeds and block navigation to domains associated with browser exploit kits
How to Mitigate CVE-2026-58299
Immediate Actions Required
- Update Microsoft Edge for Android to the latest version available through the Google Play Store
- Enforce mobile browser version compliance policies via MDM to block outdated Edge installations
- Notify users of the risk of navigating to untrusted links until the update is confirmed across the fleet
Patch Information
Microsoft has released a security update addressing CVE-2026-58299. Deployment details, affected build numbers, and remediation guidance are published in the Microsoft Security Update CVE-2026-58299 advisory. Administrators should validate that managed Android devices receive the updated Edge package through Google Play or their enterprise app distribution channel.
Workarounds
- Restrict use of Microsoft Edge on Android until the patched version is installed on all managed devices
- Route mobile browser traffic through an enterprise secure web gateway that blocks known exploit domains
- Enable safe browsing and enhanced protection features within Microsoft Edge for Android configuration policies
- Educate users to avoid opening untrusted links delivered via SMS, email, or messaging applications on mobile devices
# Example: enforce minimum Edge for Android version via Microsoft Intune app configuration
# Replace <PATCHED_VERSION> with the fixed build listed in the MSRC advisory
AppPackageId=com.microsoft.emmx
MinimumAppVersion=<PATCHED_VERSION>
BlockLaunchIfBelowMinimum=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
