SB2026080201 - Two vulnerabilities in Microsoft Edge for Android

Description

This security bulletin contains information about 2 vulnerabilities.

1) External Control of File Name or Path (CVE-ID: CVE-2026-66310)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to external control of file name or path in Microsoft Edge for Android when processing a crafted website or URL. A remote attacker can cause the browser to access an attacker-controlled file name or path to disclose sensitive information.

2) External Control of File Name or Path (CVE-ID: CVE-2026-65802)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to external control of file name or path in Microsoft Edge for Android when processing an attacker-controlled webpage that triggers autofill. A remote attacker can cause the victim to visit a specially crafted webpage and perform two tap gestures to disclose sensitive information.

User interaction is required to visit the attacker-controlled webpage and perform the two tap gestures that activate autofill. Successful exploitation can affect resources beyond the security scope of the vulnerable component.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-66310
• https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-65802