Security readout for executives and security teams
Plain-English summary
Microsoft Edge for Android has a flaw that lets an attacker sidestep one of the browser's built-in safety controls when a user is tricked into interacting with malicious content over the network. It does not directly expose data or crash the device on its own, but it weakens a protection users rely on. Microsoft has published guidance through its Security Update Guide.
Executive priority
Treat as a moderate, patch-on-normal-cycle item for mobile browser fleets. There is no evidence of active exploitation, but the flaw weakens a browser safety control and should be closed through routine Edge updates on Android, particularly for executives and staff who browse on mobile devices.
Technical view
CVE-2026-58523 is an improper access control issue (CWE-284) in Microsoft Edge for Android that enables a network-based, unauthenticated attacker to bypass a security feature. CVSS 3.1 is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) with user interaction required. Exploit code maturity is unproven and an official remediation is listed. Confidentiality impact is rated high; integrity and availability are unaffected.
Likely exposure
Any Android device running Microsoft Edge is potentially in scope. Exposure concentrates on mobile users who browse untrusted links, since exploitation requires user interaction with attacker-controlled content over the network. Enterprises with BYOD or unmanaged mobile browsers face broader exposure than those with mobile device management enforcing browser updates.
Exploitation context
Microsoft's advisory lists exploit code maturity as unproven and CISA KEV does not track this CVE as actively exploited. The vector requires user interaction, which raises the bar for opportunistic attacks but keeps social-engineering and malicious-link scenarios viable. No public proof-of-concept is cited in the source bundle.
Researcher notes
Source bundle names only "Microsoft Edge (Chromium-based)" version 1.0.0.0 as a placeholder; the MSRC advisory should be consulted for the actual fixed build number on Android. CWE-284 and the CVSS vector suggest a control that gates sensitive functionality is reachable without proper authorization when a user interacts with crafted web content. No KEV listing, no public PoC cited.
Mitigation direction
- Apply the Microsoft Edge for Android update referenced in the MSRC advisory as it becomes available.
- Enforce automatic updates for Edge through Google Play and mobile device management.
- Advise users to avoid untrusted links and unknown web content on mobile browsers.
- Track MSRC guidance for revised fix versions and configuration notes.
Validation and detection
- Inventory Android devices with Microsoft Edge installed via MDM or endpoint reporting.
- Confirm installed Edge versions against the fixed build listed in the MSRC advisory.
- Verify Google Play auto-update is enabled on managed Android fleets.
- Review mobile browsing telemetry for anomalous redirects or security prompts being suppressed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-58523 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C2.83.6microsoftVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Microsoft Edge for Android Security Feature Bypass VulnerabilityCVE reference, microsoft · vendor-advisory, patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.