CVE-2026-58300

Executive Summary

CVE-2026-58300 is an absolute path traversal vulnerability in Microsoft Edge for Android, attributed to the vendor Absolute. The flaw allows an unauthorized attacker to disclose sensitive information locally by manipulating file paths. With a CVSS score of 6.2 (Medium), the vulnerability requires local access and user interaction, but no privileges. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the lack of a patch makes it a persistent risk for Android users of Microsoft Edge. No public exploit code or proof-of-concept is available, and no supply chain packages (NPM, PyPI, Go, Ruby) are affected.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
• Base Score: 6.2 (Medium)
• Attack Vector: Local (AV:L) – requires physical or emulated access to the device.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: None (PR:N) – attacker does not need authentication.
• User Interaction: Required (UI:R) – victim must open a malicious link or file.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – sensitive local files can be read.
• Integrity Impact: None (I:N) – no file modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. The vulnerability is not remotely exploitable and requires user interaction, but the potential for local information disclosure (e.g., credentials, tokens, app data) is significant.

Deep Dive & Mechanics

The vulnerability resides in how Microsoft Edge for Android handles file:// URIs and local resource requests. An absolute path traversal occurs when the browser fails to properly sanitize user-supplied paths, allowing an attacker to escape the intended sandbox directory and read arbitrary files on the device’s filesystem.

Root Cause: The browser’s file access logic does not validate that the requested path stays within the allowed scope (e.g., the app’s data directory). By crafting a URI like file:///data/data/com.absolute.edge/shared_prefs/../../../../sdcard/private.txt, an attacker can traverse up the directory tree and access files outside the sandbox.

Attack Vector:

1. The attacker hosts a malicious webpage or sends a crafted link via SMS/email.
2. The victim opens the link in Microsoft Edge for Android.
3. The browser processes the file:// URI without proper path normalization.
4. The attacker reads sensitive files (e.g., /data/system/packages.xml, /sdcard/Download/credentials.txt).

Impact: Local information disclosure, potentially exposing authentication tokens, app data, or system configuration files.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable behavior to expected secure handling.

Vulnerable Code (Conceptual):

// Vulnerable: No path validation
String path = request.getPath();
File file = new File(path);
if (file.exists()) {
    // Serve file content
}

Patched Code (Expected):

// Patched: Validate path is within allowed directory
String baseDir = "/data/data/com.absolute.edge/";
String path = request.getPath();
File file = new File(baseDir, path);
String canonicalPath = file.getCanonicalPath();
if (!canonicalPath.startsWith(baseDir)) {
    throw new SecurityException("Path traversal detected");
}
if (file.exists()) {
    // Serve file content
}

The patched version uses getCanonicalPath() to resolve symbolic links and .. sequences, then checks that the resolved path starts with the allowed base directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Android device with Microsoft Edge for Android installed (vulnerable version).
• Ability to deliver a crafted URI to the victim (e.g., via phishing link).

Exploitation Steps:

1. Craft a malicious URI:

   file:///data/data/com.absolute.edge/../../../../sdcard/Download/secret.txt
   

2. Host a webpage that triggers the URI via JavaScript or an <a> tag:

   <a href="file:///data/data/com.absolute.edge/../../../../sdcard/Download/secret.txt">Click here</a>
   

3. Send the link to the victim via SMS, email, or social engineering.
4. When the victim clicks, Edge will attempt to read the file and display its contents (or leak via error messages).

Note: No public exploit code exists; this is a conceptual demonstration.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual file:// URI requests in browser logs.
• Use endpoint detection rules (see Sigma rule below).
• Alert on attempts to access paths outside the app sandbox.

Defense:

• Apply the patch once released by Absolute/Microsoft.
• Restrict file:// URI handling via browser policies (e.g., Group Policy for Android Enterprise).
• Educate users not to click on suspicious links.

Indicators of Compromise (IOCs)

• File Paths Accessed:
  • /data/data/com.absolute.edge/../../../../sdcard/
  • /data/data/com.absolute.edge/../../../../system/
• Network Traffic: Unusual outbound connections from Edge to attacker-controlled servers (if data is exfiltrated).
• Process Anomalies: Edge process reading files outside its sandbox (detectable via auditd or SELinux denials).
• Log Entries:
  • Android logcat: Edge: Accessing file: /data/data/com.absolute.edge/../../../../sdcard/secret.txt
  • Browser console: Failed to load resource: net::ERR_FILE_NOT_FOUND (if file doesn’t exist).

Detection Engineering

YARA Rule

rule CVE_2026_58300_PathTraversal {
    meta:
        description = "Detects absolute path traversal attempts in Microsoft Edge for Android"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-58300"
    strings:
        $traversal1 = "../../../../" ascii wide
        $traversal2 = "file:///data/data/com.absolute.edge/" ascii wide
        $traversal3 = "..%2f..%2f..%2f..%2f" ascii wide  // URL-encoded variant
    condition:
        any of ($traversal*) and filesize < 10KB
}

Sigma Rule

title: CVE-2026-58300 - Absolute Path Traversal in Microsoft Edge for Android
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects file:// URI requests with path traversal patterns in Microsoft Edge for Android logs
author: Valters IT
date: 2025-04-10
logsource:
    product: android
    service: logcat
detection:
    selection:
        EventID: 1001  # Example: Browser file access event
        ProcessName: 'com.microsoft.emmx'  # Edge package name
        TargetObject|contains: 
            - '../../../../'
            - '..%2f..%2f..%2f..%2f'
    condition: selection
falsepositives:
    - Legitimate file access within sandbox (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-58300 - Absolute Path Traversal in Microsoft Edge for Android"; flow:to_server,established; content:"file:///data/data/com.absolute.edge/"; nocase; content:"../../../../"; distance:0; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file:// URI handling in Microsoft Edge for Android via enterprise policy (if available).
2. Monitor for exploitation using the provided detection rules.
3. Restrict app permissions – ensure Edge does not have unnecessary storage permissions.

Long-Term Fix:

• Apply the official patch from Absolute/Microsoft once released.
• Update Microsoft Edge for Android to the latest version from Google Play Store.
• Implement application sandboxing and path validation in custom Android apps.

Workaround:

• Use a different browser (e.g., Chrome, Firefox) until the patch is applied.
• Educate users to avoid clicking on links from untrusted sources.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert