CVE-2026-65802 Overview
CVE-2026-65802 is an information disclosure vulnerability in Microsoft Edge for Android. The flaw stems from external control of a file name or path [CWE-73], allowing an unauthorized attacker to disclose sensitive information over a network. Exploitation requires user interaction, such as visiting a crafted webpage or interacting with a malicious link. Successful exploitation lets an attacker access files outside the expected browser scope, exposing confidential data stored on the mobile device.
Critical Impact
An unauthorized network attacker can trigger disclosure of files by controlling a file name or path handled by Microsoft Edge for Android, resulting in high-impact confidentiality loss with a scope change.
Affected Products
- Microsoft Edge for Android
Discovery Timeline
- 2026-08-04 - CVE-2026-65802 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-65802
Vulnerability Analysis
CVE-2026-65802 is classified under CWE-73: External Control of File Name or Path. The vulnerability arises when Microsoft Edge for Android accepts a file name or path derived from attacker-controlled input without proper validation. An attacker can craft input that references files outside the intended directory, producing an information disclosure condition.
The scope-changed impact indicates the vulnerable component can affect resources beyond its own security boundary. This aligns with Android's file access model, where browsers hold permissions that can reach content providers and shared storage. A successful attack requires user interaction, typically clicking a link or opening a crafted resource.
EPSS data places the exploitation probability at approximately 0.942% with a percentile near 57.6, indicating moderate near-term interest relative to other published CVEs.
Root Cause
The root cause is improper validation of a file name or path parameter influenced by external input. The browser trusts the supplied value when constructing a file operation, allowing traversal or reference to unintended resources. Standard mitigations include canonicalization and allowlist validation before performing file operations.
Attack Vector
The attack vector is network-based with low complexity and no privileges required. An attacker hosts a crafted webpage or delivers a malicious link. When the victim opens the resource in Microsoft Edge for Android and completes the required interaction, the browser processes the attacker-controlled file reference and returns file content or metadata to the attacker-controlled channel.
No public proof-of-concept or exploit code has been published for CVE-2026-65802 at the time of this writing. See the Microsoft Security Update Guide for vendor technical details.
Detection Methods for CVE-2026-65802
Indicators of Compromise
- Outbound HTTP or HTTPS requests from Microsoft Edge for Android to unfamiliar domains immediately after a user opens an external link.
- Unexpected file-read operations by the Edge process targeting shared storage, cache directories, or content provider URIs.
- Anomalous URL patterns containing encoded path traversal sequences or file:// references delivered through third-party apps or messaging clients.
Detection Strategies
- Inspect mobile browser telemetry for URI schemes and intent handlers that reference local files or content providers with attacker-controlled parameters.
- Correlate web proxy logs with mobile device management (MDM) inventory to identify Android endpoints running vulnerable Edge versions and visiting suspicious hosts.
- Deploy behavioral analytics that flag deviations in Edge for Android outbound traffic, focusing on unexpected upload payloads following link clicks.
Monitoring Recommendations
- Track Microsoft Edge for Android version distribution across managed devices and alert on unpatched builds.
- Ingest mobile browser and network telemetry into a centralized analytics platform for cross-source correlation.
- Monitor Microsoft security advisories for updates to CVE-2026-65802, including patch revisions and detection guidance.
How to Mitigate CVE-2026-65802
Immediate Actions Required
- Update Microsoft Edge for Android to the latest version available through the Google Play Store as soon as the vendor patch is published.
- Advise users to avoid opening untrusted links in Microsoft Edge for Android until the update is applied enterprise-wide.
- Enforce mobile device management policies that require current browser versions on corporate and BYOD Android devices.
Patch Information
Microsoft has documented CVE-2026-65802 in the Microsoft Security Update Guide. Administrators should consult the advisory for the specific fixed version of Microsoft Edge for Android and deploy updates through Google Play or MDM-managed application distribution.
Workarounds
- Configure MDM policies to restrict Microsoft Edge for Android as the default handler for untrusted intents until the patch is deployed.
- Route mobile browser traffic through a secure web gateway that blocks known malicious URLs and inspects file access patterns.
- Provide targeted user awareness communications that discourage clicking unsolicited links delivered through SMS, email, or chat.
# Example: force-update Microsoft Edge on managed Android devices via ADB in a lab context
adb shell pm list packages | grep com.microsoft.emmx
adb shell am force-stop com.microsoft.emmx
# Then push the updated APK through your MDM or Managed Google Play channel
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
