edge_chromium: Relative Path Traversal (CVE-2026-58522)

Description

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

Metrics

Weakness classes (CWE)

• CWE-23Base

  Relative Path Traversal

  The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

  cwe.mitre.org →

References & sources

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58522
  vendor-advisorypatch

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

1. Initial Analysis2026-07-07 22:52 UTC· nvd@nist.gov
   • CVSS V3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
   • CPE Configuration: AND OR *cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* versions up to (excluding) 150.0.4078.48 OR cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
   • Reference Type: Microsoft Corporation: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58522 Types: Vendor Advisory
2. CVE Modified2026-07-06 12:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
   • SSVC: {"id":"CVE-2026-58522","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technical…
3. New CVE Received2026-07-03 21:17 UTC· secure@microsoft.com
   • Affected: Microsoft Edge (Chromium-based)
   • Description: Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
   • CVSS V3.1: AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
   • CWE: CWE-23

Linked advisories

• sans-atrisk-mail2026-07-16 00:00 UTC
  @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 27