CVE-2026-58525: Microsoft Edge Bypass Flaw Exposes Autofill Data via Two Taps

Microsoft has disclosed a new security feature bypass vulnerability in Edge (Chromium-based) that could let attackers siphon sensitive autofill data using nothing more than a malicious webpage and two carefully timed tap gestures.

Tracked as CVE-2026-58525, the flaw was published on July 8, 2026, and carries a CVSS 3.1 base score of 8.2 (temporal score 7.1), landing it in the “Important” severity bucket despite Microsoft’s assessment that exploitation is currently unlikely.

The vulnerability stems from improper access control (CWE-284) within Edge’s handling of autofill interactions, allowing an unauthorized attacker to circumvent security boundaries that normally protect user data from unauthenticated network-based attacks.

Microsoft Edge Bypass Flaw

Unlike traditional exploits that rely on complex payloads or memory corruption, this bypass hinges on social engineering combined with a UI-level access control gap. According to Microsoft’s FAQ, an attacker would host a specially crafted website and lure a victim to it via phishing emails, instant messages, or malicious attachments.

Once on the page, the attack requires the victim to perform two tap gestures, inadvertently triggering Edge’s autofill mechanism.

This interaction requirement (UI:R in the CVSS vector) is critical: Microsoft explicitly notes that attackers “would have no way to force a user to view the attacker-controlled content.” The exploit depends entirely on convincing a target to engage, making it a hybrid of technical flaw and social engineering.

The CVSS vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, tells a nuanced story. The attack vector is network-based (AV:N), low complexity (AC:L), and requires no privileges (PR:N), meaning that any unauthenticated attacker can attempt to exploit it remotely.

The scope is changed (S:C), indicating the vulnerability affects resources beyond the vulnerable component itself.

Confidentiality impact is rated high (C:H), meaning successful exploitation could expose sensitive autofill data, such as saved credentials, addresses, or payment details. Integrity impact is low (I:L), allowing limited modification of disclosed information, while availability remains unaffected (A:N), so the attack won’t crash Edge or disrupt browsing functionality.

Microsoft’s Exploitability Index currently rates this as “Exploitation Unlikely,” and there’s no evidence of public disclosure or active exploitation in the wild as of the release date.

This aligns with the Remediation Level “Official Fix” (RL:O) and Report Confidence “Confirmed” (RC:C) markers in the CVSS temporal metrics, suggesting Microsoft has already validated the issue and shipped a patch.

The fix ships in Microsoft Edge version 150.0.4078.50, released July 8, 2026, based on Chromium version 150.0.7871.47. Organizations running Edge should verify their deployment matches or exceeds this build, particularly in enterprise environments where autofill is commonly enabled for productivity workflows.

“Autofill vulnerabilities occupy a dangerous middle ground they don’t need sophisticated exploit chains, just a plausible pretext and a distracted user. The ‘two-tap’ requirement here isn’t much of a barrier; it’s the kind of friction phishing kits are specifically designed to overcome,” says one browser security researcher tracking Chromium-based patch cycles.

Mitigation

Update Edge to version 150.0.4078.50 or later immediately across managed endpoints.
Review autofill settings in enterprise policy configurations and disable autofill for sensitive fields where feasible.
Reinforce user awareness training around unsolicited links and attachments, since exploitation still requires user interaction.
Monitor for updated exploitability assessments, as “Unlikely” ratings can shift once proof-of-concept code circulates publicly.

While no active exploitation has been reported, the low complexity and network-based nature of CVE-2026-58525 make timely patching a sensible baseline defense rather than an optional precaution.