CVE-2026-66310: High File Path Flaw in Microsoft Edge for Android

CVE-2026-66310 is a high severity (CVSS 7.7) external control of file name or path flaw in Microsoft Edge for Android. The record says an unauthorized attacker could disclose information locally. Microsoft lists version 151.0.4129.59 as fixed. Update Edge on Android devices through Google Play.

What's affected

The record describes external control of file name or path (CWE-73) in Microsoft Edge for Android, allowing an unauthorized attacker to disclose information locally.

Microsoft's update guide lists Microsoft Edge for Android with fixed version 151.0.4129.59. Its FAQ gives the release date as 31 July 2026 and the Chromium base as 151.0.7922.71 or .72.

Microsoft scores it 7.7 with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, which matches the record. Local attack vector, no privileges and no user interaction. Microsoft says the type of information disclosed is sensitive information and gives no further detail.

One small date note. The record's published date is 4 August 2026, while Microsoft's guide places the release in its July 2026 release, dated 31 July. Neither source explains the gap, and it does not change what to do.

How to check if you're exposed

On a device, open Edge and read the version in its settings under About. Anything below 151.0.4129.59 on Android is behind the fix. In a managed fleet, your mobile device management tool can list installed app versions, so filter for Edge and compare.

The local vector means the attacker needs to run something on the device, such as another app. That points to unmanaged apps and sideloaded software as the main risk, more than web browsing.

What to do now

1. Report Edge for Android versions from your mobile management tool.
2. Update to 151.0.4129.59 or later from Google Play.
3. Review apps installed on managed Android devices and remove ones you do not recognize.
4. Where you can, require a minimum Edge version for access to corporate resources.
5. Check the update guide entry for any later revision.

Why it matters

When a program lets outside input decide which file it opens or where it writes, an attacker can point it at a file that was never meant to be shared. Browsers keep profile data, cookies and downloads on disk, so the stakes in a browser are about the user's stored data.

The vector rates both confidentiality and integrity as high. Microsoft's description and the record talk about disclosure, so treat the integrity rating as a reason to patch quickly instead of a reason to guess at attacks.

Microsoft marks it as not publicly disclosed and not exploited at release, with exploitation unlikely. The record's KEV flag is false.

Quick check

Sources

• Microsoft Security Response Center update guide entry for CVE-2026-66310
• NVD record for CVE-2026-66310

Last reviewed: 18 October 2026.