Microsoft Edge for Android Time-of-Check Time-of-Use Race Condition Remote Code Execution Vulnerability

A time-of-check time-of-use (TOCTOU) race condition vulnerability has been identified in Microsoft Edge for Android. This vulnerability allows an unauthorized attacker to execute code remotely over a network. The issue arises from a race condition that can be exploited by manipulating the timing of events, leading to unauthorized code execution.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected device.

Reproduction

To reproduce this vulnerability, a user must open a specially crafted file from an attacker while using Microsoft Edge for Android. This action will trigger the race condition, allowing the attacker to execute code remotely on the device.

Remediation

Users can download the security update for Microsoft Edge (Chromium-based) from the Microsoft Edge Release Notes - Security page.