Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVE-2026-58525) — Threadlinqs Intelligence
As of 2026-07-19, Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVE-2026-58525) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-1505 · Severity: HIGH · CVSS: 8.2 · Status: ACTIVE · Category: VULNERABILITY
CVE-2026-58525 is a CVSS 8.2 improper-access-control flaw (CWE-284) in Microsoft Edge (Chromium-based) prior to version 150.0.4078.50 that lets a remote, unauthenticated attacker bypass a browser
CVE-2026-58525 was disclosed by Microsoft on July 8, 2026 as part of the July 2026 Patch Tuesday release, which the Zero Day Initiative's monthly review characterized as an unusually large cycle — ZDI's published review states the month shipped 621 CVEs in total, of which a large cluster (reported elsewhere as roughly 480) were Chromium-related, calling it a 'Mother of All Releases.' The flaw is classified as CWE-284 (Improper Access Control) in the Chromium-based build of Microsoft Edge and carries a CVSS 3.1 base score of 8.2 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C, temporal ~7.1); NVD has not yet published a CVSS v4.0 assessment for this CVE. The attack path requires no authentication and no special privileges, but does require user interaction: an attacker hosts a specially crafted web page and must entice a target to open it, typically via a phishing email, instant-message lure, or a malicious attachment/link sent through email — this enticement-via-attachment vector is explicitly called out in Microsoft's own description of the attack path. Once the page is loaded, the improper access-control logic allows the attacker to circumvent an expected browser security restriction, changing the scope of impact (S:C) and yielding high confidentiality impact (C:H) with limited integrity impact (I:L) and no availability impact (A:N) — consistent with a security-boundary bypass that exposes browser-protected data or state (e.g., session/origin-isolation data) rather than granting code execution or denial of service. Microsoft's own exploitability metrics record E:U (exploit code maturity unknown), RL:O (official fix available), and RC:C (report confidence confirmed); CISA's SSVC scoring for the CVE records exploitation status as 'none,' automatable as 'no,' and technical impact as 'partial.' Neither Microsoft, GovCERT.HK, nor the Zero Day Initiative's July 2026 review report any public proof-of-concept or in-the-wild exploitation as of publication, and the CVE is absent from the CISA Known Exploited Vulnerabilities (KEV) catalog as of 2026-07-19. Microsoft fixed the issue in Edge Stable 150.0.4078.50 (released July 8, 2026 across Windows, macOS, and other supported channels), and GovCERT.HK issued Security Alert A26-07-16 the following day urging Hong Kong organizations to update. The July 2026 Patch Tuesday cycle also shipped two closely related Edge (Chromium-based) Security Feature Bypass vulnerabilities — CVE-2026-57983 (CVSS 8.7) and CVE-2026-58295 (CVSS 8.3) — plus a lower-severity companion, CVE-2026-58523, affecting Microsoft Edge for Android (CVSS 6.5), indicating a cluster of access-control hardening fixes shipped to the Edge/Chromium codebase in the same release rather than an isolated one-off defect. NVD's record and third-party trackers (thewindowsupdate.com, datacomm.com, cve.threatint) mirror MSRC's advisory text verbatim, with no independent technical write-up, exploit chain analysis, or PoC code published by any tracked source, reflecting the genuinely thin public documentation typical of this CVE class before independent researchers reverse-engineer the patch diff.
Target sectors: government administration, enterprise, finance, health, technology, all-browser-users
Target regions: hong kong, Global
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-58525, T1594, T1583, T1608, T1189, T1566, T1204, T1211, T1685, T1548, T1217
