CVE-2026-58522

Executive Summary

CVE-2026-58522 is a relative path traversal vulnerability in Microsoft Edge for Android. The flaw allows an unauthorized attacker to disclose information locally by exploiting improper input validation when the browser handles file paths. With a CVSS score of 6.8, this vulnerability is considered medium severity but poses a significant risk to user privacy and data confidentiality on Android devices. The vulnerability is currently unpatched, and no public proof-of-concept or exploit code is available. The attack requires local access and user interaction, making it a targeted threat rather than a widespread automated attack.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is specific to the Microsoft Edge browser for Android, which is distributed through the Google Play Store and Microsoft’s own channels. The supply chain risk is limited to the integrity of the Edge APK and its updates.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
• Base Score: 6.8 (Medium)
• Attack Vector: Local (AV:L) – The attacker must have physical or logical access to the device.
• Attack Complexity: Low (AC:L) – No special conditions are required to exploit.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: Required (UI:R) – The victim must perform an action, such as opening a malicious file or link.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Sensitive local files can be read.
• Integrity Impact: None (I:N) – No data modification is possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for local access and user interaction reduces the likelihood of mass exploitation, but the potential for data theft makes it a serious concern for targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in how Microsoft Edge for Android resolves file paths when handling local resources. The browser fails to properly sanitize user-supplied input used in file path construction, allowing an attacker to traverse directories outside the intended sandbox. By crafting a malicious URL or file that includes path traversal sequences (e.g., ../), an attacker can read arbitrary files on the device’s filesystem, such as cookies, cache, or other application data.

The root cause is a lack of canonicalization of file paths before access. The browser’s file handler does not check for relative path components, enabling an attacker to escape the designated storage directory. This is a classic CWE-23: Relative Path Traversal vulnerability.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described below. The patched version would include proper path canonicalization and validation.

Vulnerable Code (Conceptual):

function readLocalFile(userInput) {
    let basePath = "/data/data/com.microsoft.emmx/files/";
    let fullPath = basePath + userInput;
    // No validation of userInput
    let content = fs.readFileSync(fullPath);
    return content;
}

Patched Code (Conceptual):

const path = require('path');
function readLocalFile(userInput) {
    let basePath = "/data/data/com.microsoft.emmx/files/";
    let fullPath = path.resolve(basePath, userInput);
    // Ensure the resolved path is within the base directory
    if (!fullPath.startsWith(basePath)) {
        throw new Error("Invalid path");
    }
    let content = fs.readFileSync(fullPath);
    return content;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Android device with Microsoft Edge installed (vulnerable version).
• Ability to deliver a malicious file or URL to the victim (e.g., via phishing, malicious app, or physical access).

Exploitation Steps:

1. Craft a malicious HTML file that uses an iframe or JavaScript to load a local file via Edge’s file handler.
2. Example payload:

   <iframe src="file:///data/data/com.microsoft.emmx/../../../../data/data/com.android.chrome/databases/webview.db"></iframe>
   

3. Host the file on a local server or deliver it via email.
4. When the victim opens the file in Edge, the browser will attempt to load the specified local file, leaking its contents.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor for unusual file access patterns by Edge, especially attempts to read files outside its sandbox.
• Use file integrity monitoring (FIM) to detect unauthorized reads of sensitive files.
• Enable Android’s auditd to log file access events.

Prevention:

• Apply the patch as soon as it becomes available.
• Restrict Edge’s permissions to access local files via Android’s permission model.
• Educate users about the risks of opening untrusted files or links.

Indicators of Compromise (IOCs)

• File Paths: /data/data/com.microsoft.emmx/ (Edge’s sandbox directory)
• Log Entries: Edge attempting to read files outside its sandbox, e.g., /data/data/com.android.chrome/
• Network Traffic: Unusual outbound connections from Edge after file access (if data is exfiltrated).
• Process Anomalies: Edge process spawning unexpected child processes or accessing unusual file descriptors.

Detection Engineering

YARA Rule

rule CVE_2026_58522_Edge_Android_PathTraversal {
    meta:
        description = "Detects attempts to exploit relative path traversal in Microsoft Edge for Android"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-58522"
    strings:
        $s1 = "../" ascii wide
        $s2 = "file:///" ascii wide
        $s3 = "/data/data/" ascii wide
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2026-58522 - Relative Path Traversal in Microsoft Edge for Android
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects file access attempts by Edge outside its sandbox directory
author: Valters IT
date: 2026-01-01
logsource:
    product: android
    service: auditd
detection:
    selection:
        EventID: 1110  # File access event
        ProcessName: 'com.microsoft.emmx'
        FilePath|contains: '/data/data/'
        FilePath|re: '\.\./'
    condition: selection
falsepositives:
    - Legitimate file access by Edge within its sandbox
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-58522 - Edge Android Path Traversal Attempt"; flow:to_server; content:"file:///"; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Apply the official patch from Microsoft as soon as it is released. Monitor the Microsoft Security Response Center (MSRC) for updates.
2. Workaround: Disable the ability for Edge to access local files by modifying the browser’s configuration or using Android’s permission management.
3. User Education: Advise users not to open suspicious files or links, especially those that reference local file paths.
4. Monitoring: Implement the detection rules above to identify exploitation attempts.
5. Least Privilege: Ensure Edge runs with the minimum necessary permissions on Android.

Valters IT
DevSecOps & Cyber Threat Intelligence