This vulnerability (CWE-36) in Microsoft Edge for Android involves absolute path traversal, which enables an attacker without privileges or user interaction to disclose sensitive local information. The vulnerability is confirmed and published with a CVSS 3.1 score of 6.2, indicating a medium impact primarily on confidentiality. Microsoft has released an official fix for this issue as documented in their security update guide.

Successful exploitation allows an attacker to disclose local information on the affected device without requiring privileges or user interaction. The integrity and availability of the system are not impacted. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Microsoft Edge (Chromium-based) on Android as detailed in the vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58300. No additional mitigation steps are indicated by the vendor.