# Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVE-2026-58525)

> CVE-2026-58525 is a CVSS 8.2 improper-access-control flaw (CWE-284) in Microsoft Edge (Chromium-based) prior to version 150.0.4078.50 that lets a remote, unauthenticated attacker bypass a browser security restriction if a user is enticed to open a specially crafted web page. No public PoC and no active exploitation are reported; Microsoft rates it 'Important' with Exploit Code Maturity Unknown (E:U), and CISA SSVC rates exploitation as 'none' and technical impact as 'partial'.

- **Published:** 2026-07-08T00:00:00Z
- **Last reviewed:** 2026-07-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1505
- **ID:** TL-2026-1505
- **Severity:** HIGH (CVSS 8.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-58525

## Description

CVE-2026-58525 was disclosed by Microsoft on July 8, 2026 as part of the July 2026 Patch Tuesday release, which the Zero Day Initiative's monthly review characterized as an unusually large cycle — ZDI's published review states the month shipped 621 CVEs in total, of which a large cluster (reported elsewhere as roughly 480) were Chromium-related, calling it a 'Mother of All Releases.' The flaw is classified as CWE-284 (Improper Access Control) in the Chromium-based build of Microsoft Edge and carries a CVSS 3.1 base score of 8.2 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C, temporal ~7.1); NVD has not yet published a CVSS v4.0 assessment for this CVE. The attack path requires no authentication and no special privileges, but does require user interaction: an attacker hosts a specially crafted web page and must entice a target to open it, typically via a phishing email, instant-message lure, or a malicious attachment/link sent through email — this enticement-via-attachment vector is explicitly called out in Microsoft's own description of the attack path. Once the page is loaded, the improper access-control logic allows the attacker to circumvent an expected browser security restriction, changing the scope of impact (S:C) and yielding high confidentiality impact (C:H) with limited integrity impact (I:L) and no availability impact (A:N) — consistent with a security-boundary bypass that exposes browser-protected data or state (e.g., session/origin-isolation data) rather than granting code execution or denial of service. Microsoft's own exploitability metrics record E:U (exploit code maturity unknown), RL:O (official fix available), and RC:C (report confidence confirmed); CISA's SSVC scoring for the CVE records exploitation status as 'none,' automatable as 'no,' and technical impact as 'partial.' Neither Microsoft, GovCERT.HK, nor the Zero Day Initiative's July 2026 review report any public proof-of-concept or in-the-wild exploitation as of publication, and the CVE is absent from the CISA Known Exploited Vulnerabilities (KEV) catalog as of 2026-07-19. Microsoft fixed the issue in Edge Stable 150.0.4078.50 (released July 8, 2026 across Windows, macOS, and other supported channels), and GovCERT.HK issued Security Alert A26-07-16 the following day urging Hong Kong organizations to update. The July 2026 Patch Tuesday cycle also shipped two closely related Edge (Chromium-based) Security Feature Bypass vulnerabilities — CVE-2026-57983 (CVSS 8.7) and CVE-2026-58295 (CVSS 8.3) — plus a lower-severity companion, CVE-2026-58523, affecting Microsoft Edge for Android (CVSS 6.5), indicating a cluster of access-control hardening fixes shipped to the Edge/Chromium codebase in the same release rather than an isolated one-off defect. NVD's record and third-party trackers (thewindowsupdate.com, datacomm.com, cve.threatint) mirror MSRC's advisory text verbatim, with no independent technical write-up, exploit chain analysis, or PoC code published by any tracked source, reflecting the genuinely thin public documentation typical of this CVE class before independent researchers reverse-engineer the patch diff.

## MITRE ATT&CK

- T1594 Search Victim-Owned Websites
- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1189 Drive-by Compromise
- T1566 Phishing
- T1204 User Execution
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1548 Abuse Elevation Control Mechanism
- T1217 Browser Information Discovery
- T1539 Steal Web Session Cookie
- T1005 Data from Local System

## Sources

- [GovCERT.HK Security Alert (A26-07-16): Vulnerability in Microsoft Edge](https://www.govcert.gov.hk/en/alerts_detail.php?id=1956)
- [Microsoft Security Update Guide - CVE-2026-58525](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58525)
- [NVD - CVE-2026-58525](https://nvd.nist.gov/vuln/detail/CVE-2026-58525)
- [CVE-2026-58525 | THREATINT](https://cve.threatint.com/CVE/CVE-2026-58525)
- [CVE-2026-58525 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability](https://thewindowsupdate.com/2026/07/08/cve-2026-58525-microsoft-edge-chromium-based-security-feature-bypass-vulnerability/)
- [Zero Day Initiative — The July 2026 Security Update Review](https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review)
- [CVE-2026-58525 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability - DataComm Networks](https://www.datacomm.com/feed-post/cve-2026-58525-microsoft-edge-chromium-based-security-feature-bypass-vulnerability/)
- [CVE-2026-58523: Microsoft Edge for Android Security Feature Bypass (CVSS 6.5)](https://windowsforum.com/threads/cve-2026-58523-microsoft-edge-for-android-security-feature-bypass-cvss-6-5.434635/)
- [Release notes for Microsoft Edge Security Updates](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1505