Quick answers
- Is CVE-2026-62828 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-62828 being exploited in the wild.
- How severe is CVE-2026-62828?
- Medium severity, with a CVSS score of 5.4, published 28 July 2026.
- Which products and versions are affected?
- Microsoft Edge for Android All versions prior to July 2026 update.
- Is there a fix for CVE-2026-62828?
- A patch was published on 2026-07-28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-62828 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-62828?
- Check whether you run Microsoft Edge for Android at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability classified as improper input validation (CWE-20) exists in Microsoft Edge for Android. The flaw allows a remote, unauthenticated attacker to perform network-based tampering by exploiting insufficient validation of user-supplied input. Exploitation requires user interaction, typically involving the victim navigating to a specially crafted URL or malicious website. Successful exploitation could allow an attacker to compromise the integrity of the browser session or achieve partial information disclosure. Microsoft has addressed this issue in the July 2026 security updates.
Affected products
- Microsoft Edge for Android All versions prior to July 2026 update
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched