Edge Chromium (Microsoft) - vulnerabilities (CVEs)

326 CVEs, 3 in the last 30 days, 418 known versions, newest CVE from 2026-10-27. Vendor: Microsoft.

CVEs of Edge Chromium

CVE-2026-62765 - CVSS 7.5 (high), 2026-10-27: Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-85898 - CVSS 8.8 (high), 2026-10-27: Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-83831 - CVSS 8.8 (high), 2026-10-27: Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-88097 - CVSS 8.1 (high), 2026-09-18: Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.
CVE-2026-85893 - CVSS 8.8 (high), 2026-09-15: Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-69486 - CVSS 8.8 (high), 2026-09-15: Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-85892 - CVSS 7.8 (high), 2026-09-14: Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker…
CVE-2026-77490 - CVSS 6.1 (medium), 2026-09-11: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to…
CVE-2026-70341 - CVSS 8.8 (high), 2026-09-11: Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
CVE-2026-70309 - CVSS 5.4 (medium), 2026-08-28: Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-72984 - CVSS 8.8 (high), 2026-08-28: Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-66798 - CVSS 4.3 (medium), 2026-08-28: Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-66324 - CVSS 6.5 (medium), 2026-08-28: External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-66323 - CVSS 5.4 (medium), 2026-08-28: Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-62904 - CVSS 5.4 (medium), 2026-08-28: Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-58616 - CVSS 4.4 (medium), 2026-08-28: Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to…
CVE-2026-70331 - CVSS 5.4 (medium), 2026-08-28: Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-72970 - CVSS 8.3 (high), 2026-08-14: Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-70339 - CVSS 5.4 (medium), 2026-08-11: Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-66326 - CVSS 8.8 (high), 2026-08-03: Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-66325 - CVSS 6.1 (medium), 2026-08-03: Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-66317 - CVSS 5.4 (medium), 2026-08-03: Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.
CVE-2026-66322 - CVSS 7.1 (high), 2026-08-03: Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-66311 - CVSS 6.2 (medium), 2026-08-03: Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.
CVE-2026-65804 - CVSS 6.1 (medium), 2026-08-03: Improper control of generation of code ('code injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-65802 - CVSS 7.4 (high), 2026-08-03: External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.
CVE-2026-66316 - CVSS 5.4 (medium), 2026-08-03: Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-66315 - CVSS 7.5 (high), 2026-08-03: Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-66314 - CVSS 6.5 (medium), 2026-08-03: Time-of-check time-of-use (toctou) race condition in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-66313 - CVSS 6.8 (medium), 2026-08-03: Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.
CVE-2026-66312 - CVSS 8.8 (high), 2026-08-03: Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
CVE-2026-66321 - CVSS 9.6 (critical), 2026-08-03: Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-66318 - CVSS 8.1 (high), 2026-08-03: Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-57990 - CVSS 7.4 (high), 2026-07-26: Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-57989 - CVSS 7.4 (high), 2026-07-26: Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-57978 - CVSS 5.4 (medium), 2026-07-26: Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-57980 - CVSS 5.4 (medium), 2026-07-17: Authentication bypass using an alternate path or channel in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.
CVE-2026-58596 - CVSS 8.3 (high), 2026-07-12: Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-58281 - CVSS 8.3 (high), 2026-07-11: Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-58525 - CVSS 8.2 (high), 2026-07-08: Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-58523 - CVSS 6.5 (medium), 2026-07-03: Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-58291 - CVSS 6.1 (medium), 2026-07-03: Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-45489 - CVSS 6.5 (medium), 2026-07-03: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-58524 - CVSS 6.1 (medium), 2026-07-03: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to…
CVE-2026-58597 - CVSS 4.3 (medium), 2026-07-03: Insufficient ui warning of dangerous operations in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-58298 - CVSS 7.2 (high), 2026-07-03: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to…
CVE-2026-58300 - CVSS 6.2 (medium), 2026-07-03: Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
CVE-2026-58296 - CVSS 7.1 (high), 2026-07-03: Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a…
CVE-2026-58297 - CVSS 7.1 (high), 2026-07-03: Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a…
CVE-2026-58295 - CVSS 8.3 (high), 2026-07-03: Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature…
CVE-2026-58294 - CVSS 7.5 (high), 2026-07-03: Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-58293 - CVSS 8.1 (high), 2026-07-03: External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-58290 - CVSS 7.5 (high), 2026-07-03: Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-58292 - CVSS 7.5 (high), 2026-07-03: Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-58289 - CVSS 9 (critical), 2026-07-03: Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-58286 - CVSS 8.1 (high), 2026-07-03: Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-58288 - CVSS 8.3 (high), 2026-07-03: Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-58285 - CVSS 8.3 (high), 2026-07-03: Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-58278 - CVSS 5.4 (medium), 2026-07-03: Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-58284 - CVSS 8.3 (high), 2026-07-03: Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-58276 - CVSS 7.5 (high), 2026-07-03: Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-57991 - CVSS 7.4 (high), 2026-07-03: Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over…
CVE-2026-57986 - CVSS 7.5 (high), 2026-07-03: Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-57981 - CVSS 8.8 (high), 2026-07-03: Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-57974 - CVSS 8.8 (high), 2026-07-03: Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-57977 - CVSS 7.1 (high), 2026-07-03: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to…
CVE-2026-45488 - CVSS 5.9 (medium), 2026-07-03: User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a…
CVE-2026-58522 - CVSS 6.8 (medium), 2026-07-03: Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
CVE-2026-58299 - CVSS 7.5 (high), 2026-07-03: Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execute code over a network.
CVE-2026-58287 - CVSS 8.3 (high), 2026-07-03: Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-58283 - CVSS 8.1 (high), 2026-07-03: Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a…
CVE-2026-58282 - CVSS 8.1 (high), 2026-07-03: Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-56646 - CVSS 6.5 (medium), 2026-07-03: Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a…
CVE-2026-57992 - CVSS 7.5 (high), 2026-07-03: Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-57993 - CVSS 7.4 (high), 2026-07-03: Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-57988 - CVSS 7.1 (high), 2026-07-03: Relative path traversal in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-57985 - CVSS 8.8 (high), 2026-07-03: Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-57987 - CVSS 6.5 (medium), 2026-07-03: Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-57983 - CVSS 10 (critical), 2026-07-03: Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-57984 - CVSS 7.5 (high), 2026-07-03: Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-56645 - CVSS 8.8 (high), 2026-07-03: Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-57975 - CVSS 7.5 (high), 2026-07-03: Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-55945 - CVSS 4.2 (medium), 2026-07-03: Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker…
CVE-2026-50521 - CVSS 8.3 (high), 2026-07-01: Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
CVE-2026-32208 - CVSS 8.8 (high), 2026-06-19: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Entra ID allows an authorized attacker to perform spoofing…
CVE-2026-45494 - CVSS 6.1 (medium), 2026-05-18: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-45495 - CVSS 9.8 (critical), 2026-05-18: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-45492 - CVSS 5.4 (medium), 2026-05-18: Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-42838 - CVSS 5.4 (medium), 2026-05-12: Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Edge (Chromium-based) allows an unauthorized…
CVE-2026-42891 - CVSS 6.5 (medium), 2026-05-12: User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a…
CVE-2026-41107 - CVSS 7.4 (high), 2026-05-12: External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-40416 - CVSS 4.3 (medium), 2026-05-12: User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a…
CVE-2026-33118 - CVSS 4.3 (medium), 2026-04-10: User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a…
CVE-2026-0385 - CVSS 5 (medium), 2026-03-16: Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
CVE-2026-0102 - CVSS 3.1 (low), 2026-02-17: Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user…
CVE-2026-0391 - CVSS 6.5 (medium), 2026-02-05: User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-21223 - CVSS 7.1 (high), 2026-01-16: Improper privilege management in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally.
CVE-2025-65046 - CVSS 3.1 (low), 2025-12-18: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2025-14174 - CVSS 8.8 (high), 2025-12-12: Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a…
CVE-2025-62223 - CVSS 4.3 (medium), 2025-12-05: User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.