CVE-2026-66310 Overview
CVE-2026-66310 is a high-severity information disclosure vulnerability affecting Microsoft Edge for Android. The flaw stems from external control of file name or path [CWE-73], allowing an unauthorized attacker to disclose information locally on the device. Microsoft published the advisory on August 4, 2026, and it received a CVSS 3.1 score of 7.7. The attack vector is local, requires no privileges, and needs no user interaction. Successful exploitation results in high confidentiality and integrity impact on the affected mobile browser.
Critical Impact
An unauthorized local attacker can manipulate file paths in Microsoft Edge for Android to disclose sensitive information stored on the device or accessible by the browser.
Affected Products
- Microsoft Edge for Android
Discovery Timeline
- 2026-08-04 - CVE-2026-66310 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-66310
Vulnerability Analysis
The vulnerability resides in Microsoft Edge for Android and involves improper handling of file names or paths supplied from an external source. When the browser processes a path value influenced by an attacker, it fails to properly constrain access to intended file locations. This allows the browser to read or reference files outside the authorized boundary. The result is unauthorized disclosure of information stored within the browser's accessible file scope on the Android device.
The flaw is categorized under [CWE-73: External Control of File Name or Path]. This weakness class typically enables path traversal or arbitrary file read primitives when input validation is insufficient. Given the local attack vector, exploitation requires an attacker or malicious application to interact with the vulnerable component on the same device.
Root Cause
The root cause is insufficient validation of externally supplied file path input within Microsoft Edge for Android. The browser accepts path data that should be treated as untrusted without applying canonicalization or sandbox enforcement checks. This design gap permits the file resolution logic to operate on attacker-influenced paths.
Attack Vector
An attacker with local access, such as a malicious application co-resident on the Android device, can supply a crafted file path to the browser component. Because privileges required are none and user interaction is not needed, exploitation can occur silently in the background. The scope remains unchanged, meaning the impact is confined to the browser's security context, but that context includes sensitive user browsing data.
No public proof-of-concept exploit is available at the time of publication. Refer to the Microsoft Security Update Guide for CVE-2026-66310 for authoritative technical details.
Detection Methods for CVE-2026-66310
Indicators of Compromise
- Unexpected Microsoft Edge for Android processes accessing files outside the browser's standard sandbox directories.
- Presence of untrusted third-party applications on the device issuing intents or content URIs that reference sensitive file paths.
- Anomalous file read activity from the Edge application package targeting private application data directories.
Detection Strategies
- Monitor Android mobile threat defense telemetry for suspicious inter-application intents targeting Microsoft Edge.
- Review installed application inventories on managed devices for unauthorized or sideloaded applications that could stage a local attack.
- Correlate browser version telemetry with the Microsoft advisory to identify unpatched Edge for Android installations in the fleet.
Monitoring Recommendations
- Enable mobile device management (MDM) reporting to track Microsoft Edge for Android versions across enrolled devices.
- Alert on newly installed applications that request broad file or storage permissions on devices where Edge is present.
- Ingest mobile endpoint logs into a centralized analytics platform to detect deviations in browser file access patterns.
How to Mitigate CVE-2026-66310
Immediate Actions Required
- Update Microsoft Edge for Android to the latest version available in the Google Play Store immediately.
- Audit managed Android devices to confirm the patched Edge version is deployed across the fleet.
- Remove untrusted or unnecessary applications from devices that also run Microsoft Edge for Android.
Patch Information
Microsoft has released a security update addressing CVE-2026-66310. Administrators and users should consult the Microsoft Security Update Guide entry for CVE-2026-66310 for the fixed version number and deployment guidance. Updates for Microsoft Edge for Android are distributed through the Google Play Store.
Workarounds
- Restrict installation of third-party applications on Android devices used for sensitive browsing until patching is complete.
- Use an alternative browser on unpatched devices for handling sensitive content where feasible.
- Enforce mobile application management policies that isolate corporate browsing data from unmanaged applications.
# Verify Microsoft Edge for Android version via ADB on a test device
adb shell dumpsys package com.microsoft.emmx | grep versionName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
