This vulnerability involves a TOCTOU race condition in Microsoft Edge for Android, identified as CWE-367. It allows an attacker to execute code remotely by exploiting the timing between checking and using a resource. The CVSS 3.1 score is 7.5, indicating high severity, with network attack vector, high complexity, no privileges required, and user interaction needed. Microsoft has published an official fix for this vulnerability.

Successful exploitation can lead to remote code execution with high impact on confidentiality, integrity, and availability of the affected system. The attacker does not require privileges but needs user interaction and network access. This could allow unauthorized code execution on the victim's device.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58299. No additional mitigation steps are indicated by the vendor.