CVE-2026-58522 Overview
CVE-2026-58522 is a relative path traversal vulnerability [CWE-23] in Microsoft Edge for Android. An authenticated local attacker can leverage improperly sanitized path inputs to read files outside the browser's intended sandbox boundaries. The flaw enables disclosure of sensitive information stored on the device, including data that Edge normally isolates within its application storage.
The vulnerability requires local access and low-privilege execution on the target Android device. No user interaction is required to trigger the flaw. Microsoft has published an advisory through the Microsoft Security Response Center (MSRC).
Critical Impact
A local attacker with low privileges can traverse Microsoft Edge for Android's file paths to disclose confidential information without user interaction.
Affected Products
- Microsoft Edge (Chromium-based) for Android
- Google Android platform hosting the vulnerable Edge build
- Devices with Microsoft Edge installed prior to the MSRC-listed patched version
Discovery Timeline
- 2026-07-03 - CVE-2026-58522 published to the National Vulnerability Database (NVD)
- 2026-07-07 - Last updated in NVD database
Technical Details for CVE-2026-58522
Vulnerability Analysis
The vulnerability is a relative path traversal issue in Microsoft Edge for Android. Edge accepts path components that include traversal sequences such as ../ without normalizing them against the application's sandboxed root. An attacker application or local process can supply crafted paths through inter-process interfaces exposed by Edge. The browser then resolves those paths outside the intended directory and returns file contents to the caller.
The impact is limited to confidentiality. Integrity and availability of the Edge installation are not affected according to the CVSS vector. Attack complexity is low, and the attacker only needs low-level privileges on the device to invoke the vulnerable code path.
Root Cause
The root cause is missing or insufficient canonicalization of file path inputs inside Edge for Android. When the browser constructs file paths from untrusted input, it fails to reject or strip parent-directory references. This mirrors the classic [CWE-23] pattern where input like ../../data/data/com.microsoft.emmx/files/target.dat escapes the intended directory tree.
Attack Vector
An attacker executes code locally on the Android device with limited privileges, for example through a malicious app installed by the user. That app interacts with Microsoft Edge through exposed intents, content providers, or shared file interfaces. It supplies a relative path containing traversal sequences. Edge resolves the path and returns file contents that the caller should not be able to access. No user interaction is required beyond the initial presence of the attacker process on the device.
No public proof-of-concept exploit is available. Refer to the Microsoft Security Update CVE-2026-58522 advisory for vendor technical details.
Detection Methods for CVE-2026-58522
Indicators of Compromise
- Unexpected access to files under /data/data/com.microsoft.emmx/ from processes other than Edge itself
- Android logcat entries showing Edge resolving paths containing ../ sequences
- Newly installed third-party apps requesting unusual intents targeting com.microsoft.emmx
- File access timestamps on Edge profile artifacts (cookies, cache, bookmarks) that do not correlate with user browsing activity
Detection Strategies
- Inspect Android mobile threat defense (MTD) telemetry for cross-app file access targeting the Microsoft Edge package
- Review installed Edge versions across the fleet against the fixed version listed in the MSRC advisory
- Correlate application installation events with subsequent file-read anomalies on managed devices
Monitoring Recommendations
- Track Microsoft Edge for Android build numbers reported by mobile device management (MDM) enrollment records
- Alert on sideloaded APKs on managed Android devices, particularly those requesting broad intent permissions
- Monitor MSRC advisories for updates to the CVE-2026-58522 entry and any expanded affected version ranges
How to Mitigate CVE-2026-58522
Immediate Actions Required
- Update Microsoft Edge for Android to the patched version listed in the MSRC advisory
- Push the update through Google Play managed configurations or your MDM to ensure enterprise devices receive it
- Audit installed applications on Android devices and remove untrusted or sideloaded apps
Patch Information
Microsoft has released a fixed build of Edge for Android. Reference the Microsoft Security Update CVE-2026-58522 advisory for the specific version string and release channel. Devices receiving updates through the Google Play Store will install the patch automatically once available.
Workarounds
- Restrict installation of unmanaged applications on corporate Android devices via MDM policy
- Disable or restrict inter-app content provider access to Microsoft Edge where feasible
- Educate users to avoid sideloading APKs from outside the Google Play Store until patching is confirmed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
