{"id":"CVE-2026-85330","kind":"vulnerability","aliases":["CVE-2026-85330"],"related":[],"title":"Microsoft Edge for Android: authorization flaw lets attackers bypass a security feature","description":"Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.","summary":"Microsoft Edge for Android has an incorrect authorization check that lets an unauthorized attacker bypass a security feature over the network. The sources do not say which feature is bypassed or what the attacker gains beyond that.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","microsoft-edge","other"],"not_affected_if":["other-browser"],"how_to_check":"- Check the installed Edge version on Android in Edge settings (About Microsoft Edge), against the fixed version the vendor publishes","fix":null,"status":"open","published_at":"2026-10-29T16:19:31+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","triaged_at":"2026-10-29T16:31:58+00:00","updated_at":"2026-10-29T16:31:58+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-29T16:31:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Edge for Android: authorization flaw lets attackers bypass a security feature","impact":"medium","summary":"Microsoft Edge for Android has an incorrect authorization check that lets an unauthorized attacker bypass a security feature over the network. The sources do not say which feature is bypassed or what the attacker gains beyond that.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-edge","android"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker bypasses an unspecified Edge security feature over the network","analyst_note":"Find the Microsoft advisory for CVE-2026-85330 to confirm the bypassed feature, affected versions and fixed build.","how_to_check":"- Check the installed Edge version on Android in Edge settings (About Microsoft Edge), against the fixed version the vendor publishes\n- unknown for anything else: the sources do not say which setting or file would show exposure","plain_action":"Update Microsoft Edge on your Android phone from the Google Play Store once Microsoft publishes a fixed version.","needs_analyst":true,"not_affected_if":["other-browser"],"who_is_affected":"People using Microsoft Edge on Android are the ones affected; the sources do not say which Edge versions are vulnerable or which feature is bypassed. Teams that manage Android devices with Edge installed may want to check versions. unknown beyond that.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000687,"input_tokens":4071,"output_tokens":560,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-85330':15A,18A 'allow':66C 'android':4A,19B,26B,65C 'attack':8A,36B,56B,69C 'author':5A,30B,60C 'beyond':58B 'bypass':9A,37B,52B,71C 'check':31B 'cve':13A,16A 'edg':2A,22B,24B,63C 'featur':12A,40B,50B,74C 'flaw':6A 'gain':57B 'incorrect':29B,59C 'let':7A,33B 'microsoft':1A,21B,23B,62C 'microsoft-edg':20B 'network':43B,77C 'say':48B 'secur':11A,39B,73C 'sourc':45B 'unauthor':35B,68C","nicknames":[],"mitigations":[],"who_affected":"People using Microsoft Edge on Android are the ones affected; the sources do not say which Edge versions are vulnerable or which feature is bypassed. Teams that manage Android devices with Edge installed may want to check versions. unknown beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Update Microsoft Edge on your Android phone from the Google Play Store once Microsoft publishes a fixed version.","first_public_at":"2026-10-29T16:19:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85330","severity":null,"published_at":"2026-10-29T16:19:31+00:00","modified_at":"2026-10-29T16:19:31+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","fetched_at":"2026-10-29T16:26:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}