CVE-2026-66310: External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-66310
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-663100.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-66310 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
Recent advisories for External control of
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- highCVE-2026-18806: External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Re…nvd · 2026-08-04
- highCVE-2026-65802: External control of file name or path in Microsoft Edge for Android allows an unauthorized att…nvd · 2026-08-04
- mediumCVE-2026-66414: Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows una…nvd · 2026-07-30
- mediumCVE-2026-7484: External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. A…nvd · 2026-07-24
- unknownCVE-2026-8920: Improper Restriction of Communication Channel to Intended Endpoints and External Control of Fil…nvd · 2026-07-15
- highCVE-2026-50462: External control of file name or path in Windows Ancillary Function Driver for WinSock allows …nvd · 2026-07-14
More from NVD Recent CVEs
- highCVE-2026-7529: The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unau…2026-08-05
- mediumCVE-2026-7456: The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to …2026-08-05
- highCVE-2026-67623: Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attacker…2026-08-05
- highCVE-2026-17506: The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi…2026-08-05
- highCVE-2026-16443: A flaw was found in the SAML metadata import functionality of the keycloak-services component,…2026-08-05