CVE-2026-58300: Microsoft Edge Path Traversal Flaw

CVE-2026-58300 Overview

CVE-2026-58300 is an absolute path traversal vulnerability in Microsoft Edge for Android. The flaw allows an authenticated local attacker to disclose sensitive information by supplying crafted absolute file paths that bypass the browser's file access restrictions. The weakness is categorized under [CWE-36] Absolute Path Traversal.

Exploitation requires local access with low privileges and no user interaction. Successful exploitation impacts confidentiality only, with no integrity or availability effects. Microsoft has published an advisory in its Security Update Guide addressing this issue on the mobile Edge Chromium build for Android.

Critical Impact
An attacker with local access to an Android device can read files outside of Edge's intended sandbox, exposing browser artifacts, cached credentials, and other confidential data.

Affected Products

Microsoft Edge (Chromium-based) for Android
Google Android operating system
Mobile installations running vulnerable Edge builds prior to the July 2026 update

Discovery Timeline

2026-07-03 - CVE-2026-58300 published to the National Vulnerability Database
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-58300

Vulnerability Analysis

The vulnerability stems from improper validation of absolute file paths within Microsoft Edge for Android. When the browser processes file references, it fails to reject paths that resolve outside the intended application data directory. An attacker leveraging this flaw can force Edge to read arbitrary files accessible to the browser process.

The attack surface is local. A malicious application on the same device, or a crafted local resource loaded by Edge, can trigger the flawed path resolution. The confidentiality impact is high because Edge retains browsing history, cookies, cached authentication tokens, and downloaded content.

Root Cause

The root cause is missing sanitization of absolute paths in file handling routines within Edge for Android. The application accepts paths prefixed with / or containing absolute references without normalizing them against the intended base directory. This maps directly to [CWE-36] Absolute Path Traversal.

Attack Vector

Exploitation requires local access to the Android device and low-privileged execution context, such as a sideloaded app or a companion process. No user interaction is needed once the malicious component runs. The attacker crafts an absolute path reference and passes it to Edge through an intent, content URI, or local file operation.

Edge then reads the target file and returns its contents through a channel accessible to the attacker. The vulnerability does not permit code execution or data modification. See the Microsoft Security Response Center advisory for vendor-specific technical details.

Detection Methods for CVE-2026-58300

Indicators of Compromise

Unexpected inter-process communication targeting Microsoft Edge on Android devices, particularly intents containing absolute file paths
Edge process reading files outside its expected application sandbox directory
Presence of installed applications requesting broad file access alongside Edge invocations

Detection Strategies

Inspect Android application logs (logcat) for Edge file access events referencing paths outside /data/data/com.microsoft.emmx/
Deploy mobile threat defense agents that monitor cross-application intent traffic and flag suspicious URI schemes
Review installed applications on managed devices for recently sideloaded packages that interact with Edge

Monitoring Recommendations

Enable enterprise mobility management (EMM) telemetry to track Edge version compliance across the fleet
Correlate Android security logs with browser telemetry to identify anomalous local file access patterns
Monitor Microsoft Security Update Guide notifications for follow-up advisories or revised patch guidance

How to Mitigate CVE-2026-58300

Immediate Actions Required

Update Microsoft Edge for Android to the latest version available through the Google Play Store
Enforce automatic updates for Edge on managed Android devices via mobile device management (MDM) policy
Audit installed applications on Android endpoints and remove any untrusted or sideloaded packages

Patch Information

Microsoft has released an updated build of Edge for Android addressing CVE-2026-58300. Consult the Microsoft CVE-2026-58300 Update advisory for the fixed version string and release notes. Deploy the patched version through Google Play or an enterprise app distribution channel.

Workarounds

Restrict installation of third-party or sideloaded applications on Android devices through MDM policy
Disable Edge's handling of external file intents where organizational policy permits
Educate users to avoid opening untrusted links or files in Edge until patching is confirmed

bash

# Configuration example: verify Edge version on a managed Android device
adb shell dumpsys package com.microsoft.emmx | grep versionName