This vulnerability (CVE-2026-65802) in Microsoft Edge for Android is categorized under CWE-73 (External Control of File Name or Path). It allows an attacker without privileges to influence file names or paths, leading to unauthorized information disclosure over a network. The CVSS 3.1 base score is 7.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality impact. Microsoft has issued an official fix for this vulnerability as documented in their security update guide.

An attacker can cause unauthorized disclosure of information by externally controlling file names or paths in the affected Microsoft Edge version. This impacts confidentiality but does not affect integrity or availability. The vulnerability can be exploited remotely without privileges but requires user interaction.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65802. No additional mitigations are indicated by the vendor advisory.