CVE-2026-66324: CWE-73: External Control of File Name or Path in Microsoft Microsoft Edge for Android

The vulnerability identified as CVE-2026-66324 affects Microsoft Edge for Android (Chromium-based). It involves external control of file name or path (CWE-73), which can be exploited by an unauthorized attacker to conduct spoofing attacks over a network. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact. Microsoft has published an official fix for this vulnerability.

An attacker can exploit this vulnerability to spoof content or URLs in Microsoft Edge for Android, potentially misleading users or causing them to interact with malicious content. The confidentiality impact is high, but integrity and availability are not affected. No known exploits are reported in the wild.

An official fix is available from Microsoft. Users and administrators should apply the latest updates to Microsoft Edge for Android to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66324 for detailed patch information and update instructions.