Microsoft Edge Browser Web Browser based on Chromium
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Microsoft Edge Browser.
Recent Microsoft Edge Browser Security Advisories
| Advisory | Title | Published |
|---|---|---|
| CVE-2026-0391 | CVE-2026-0391 Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability | February 6, 2026 |
| CVE-2026-21223 | CVE-2026-21223 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability | January 17, 2026 |
| CVE-2025-62224 | CVE-2025-62224 Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability | January 8, 2026 |
| CVE-2023-28938 | CVE-2023-28938 Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access. | January 1, 2026 |
| CVE-2023-46343 | CVE-2023-46343 In the Linux kernel before 6.5.9 there is a NULL pointer dereference in send_acknowledge in net/nfc/nci/spi.c. | January 1, 2026 |
| CVE-2026-0102 | CVE-2026-0102 Microsoft Edge (Chromium-based) Defense in Depth Vulnerability | January 1, 2026 |
| CVE-2025-65046 | CVE-2025-65046 Microsoft Edge (Chromium-based) Spoofing Vulnerability | December 19, 2025 |
| CVE-2025-60711 | CVE-2025-60711 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | October 31, 2025 |
| CVE-2025-59251 | CVE-2025-59251 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | September 25, 2025 |
| CVE-2025-47967 | CVE-2025-47967 Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability | September 16, 2025 |
Known Exploited Microsoft Edge Browser Vulnerabilities
The following Microsoft Edge Browser vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Microsoft Edge Memory Corruption Vulnerability |
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. CVE-2016-7201 Exploit Probability: 90.1% |
March 28, 2022 |
| Microsoft Edge Memory Corruption Vulnerability |
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. CVE-2016-7200 Exploit Probability: 89.2% |
March 28, 2022 |
Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.
By the Year
In 2026 there have been 1 vulnerability in Microsoft Edge Browser with an average score of 5.5 out of ten. Last year, in 2025 Edge Browser had 22 security vulnerabilities published. Right now, Edge Browser is on track to have less security vulnerabilities in 2026 than it did last year. Last year, the average CVE base score was greater by 0.65
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 1 | 5.50 |
| 2025 | 22 | 6.15 |
| 2024 | 49 | 6.17 |
| 2023 | 41 | 5.98 |
| 2022 | 8 | 6.91 |
| 2021 | 30 | 7.65 |
| 2020 | 38 | 6.68 |
| 2019 | 87 | 6.55 |
| 2018 | 128 | 7.07 |
It may take a day or so for new Edge Browser vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Microsoft Edge Browser Security Vulnerabilities
Jan 2026: Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
CVE-2025-62224
5.5 - Medium
- January 07, 2026
User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an authorized attacker to perform spoofing over a network.
User Interface (UI) Misrepresentation of Critical Information
Dec 2025: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2025-65046
3.1 - Low
- December 18, 2025
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Authentication Bypass by Spoofing
Aug 2025: Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
CVE-2025-49755
4.3 - Medium
- August 12, 2025
User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
User Interface (UI) Misrepresentation of Critical Information
Aug 2025: Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
CVE-2025-49736
4.3 - Medium
- August 12, 2025
The ui performs the wrong action in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
The UI Performs the Wrong Action
Jul 2025: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2025-47964
5.4 - Medium
- July 11, 2025
Microsoft Edge (Chromium-based) Spoofing Vulnerability
User Interface (UI) Misrepresentation of Critical Information
Jul 2025: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-49713
8.8 - High
- July 02, 2025
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Object Type Confusion
May 2025: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2025-29825
6.5 - Medium
- May 02, 2025
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
User Interface (UI) Misrepresentation of Critical Information
Apr 2025: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-29834
7.5 - High
- April 12, 2025
Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Out-of-bounds Read
Apr 2025: Microsoft Edge for iOS Spoofing Vulnerability
CVE-2025-29796
4.7 - Medium
- April 04, 2025
User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
User Interface (UI) Misrepresentation of Critical Information
Apr 2025: Microsoft Edge for iOS Spoofing Vulnerability
CVE-2025-25001
4.3 - Medium
- April 04, 2025
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
XSS
Apr 2025: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-29815
7.6 - High
- April 04, 2025
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
Dangling pointer
Apr 2025: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-25000
8.8 - High
- April 04, 2025
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Object Type Confusion
Mar 2025: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-29806
6.5 - Medium
- March 23, 2025
No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Object Type Confusion
Mar 2025: Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability
CVE-2025-29795
7.8 - High
- March 23, 2025
Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
insecure temporary file
Mar 2025: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2025-26643
5.4 - Medium
- March 07, 2025
The UI performs the wrong action in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
The UI Performs the Wrong Action
Feb 2025: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2025-21401
4.5 - Medium
- February 15, 2025
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Open Redirect
Feb 2025: Microsoft Edge for IOS and Android Spoofing Vulnerability
CVE-2025-21253
5.3 - Medium
- February 06, 2025
Microsoft Edge for IOS and Android Spoofing Vulnerability
User Interface (UI) Misrepresentation of Critical Information
Feb 2025: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-21408
8.8 - High
- February 06, 2025
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Object Type Confusion
Feb 2025: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-21342
8.8 - High
- February 06, 2025
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Object Type Confusion
Feb 2025: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-21283
6.5 - Medium
- February 06, 2025
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Insufficient Granularity of Address Regions Protected by Register Locks
Feb 2025: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-21279
6.5 - Medium
- February 06, 2025
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Object Type Confusion
Feb 2025: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2025-21267
4.4 - Medium
- February 06, 2025
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Improperly Implemented Security Check for Standard
Jan 2025: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2025-21262
5.4 - Medium
- January 24, 2025
User Interface (UI) Misrepresentation of Critical Information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network
User Interface (UI) Misrepresentation of Critical Information
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-49041
4.3 - Medium
- December 06, 2024
Microsoft Edge (Chromium-based) Spoofing Vulnerability
The UI Performs the Wrong Action
HttpRequest Header Encoding Flaw Enables Prototype Pollution in Edge JS
CVE-2024-42330
9.1 - Critical
- November 27, 2024
The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that can be used to access hidden properties of objects.
Use of Externally-Controlled Format String
Microsoft Edge (Chromium-based) Spoofing Vulnerability CVE-2024-49054
CVE-2024-49054
- November 22, 2024
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Insufficient UI Warning of Dangerous Operations
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2024-49025
4.3 - Medium
- November 14, 2024
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Privacy violation
Microsoft Edge (Chromium) Spoofing Vulnerability
CVE-2024-43577
4.3 - Medium
- October 18, 2024
Microsoft Edge (Chromium-based) Spoofing Vulnerability
The UI Performs the Wrong Action
Microsoft Edge Chromium RCE CVE-2024-43596
CVE-2024-43596
8.8 - High
- October 17, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Object Type Confusion
CVE-2024-43595 Microsoft Edge (Chromium) RCE via Remote Exploit
CVE-2024-43595
8.8 - High
- October 17, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft Edge Chromium RCE Vulnerability
CVE-2024-43587
8.1 - High
- October 17, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Heap-based Buffer Overflow
MS Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-43580
5.4 - Medium
- October 17, 2024
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Insufficient UI Warning of Dangerous Operations
Microsoft Edge Chromium RCE Vulnerability CVE-2024-43579
CVE-2024-43579
8.3 - High
- October 17, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Heap-based Buffer Overflow
Microsoft Edge Remote Code Execution via Chromium-based Vulnerability
CVE-2024-43566
9.8 - Critical
- October 17, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Integer Overflow or Wraparound
Microsoft Edge (Chromium) RCE Vulnerability
CVE-2024-43496
8.8 - High
- September 19, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Memory Corruption
Spoofing Vulnerability in Microsoft Edge (Chromium)
CVE-2024-38221
4.3 - Medium
- September 19, 2024
Microsoft Edge (Chromium-based) Spoofing Vulnerability
XSS
Microsoft Edge Chromium Info Disclosure CVE-2024-38222
CVE-2024-38222
6.5 - Medium
- September 12, 2024
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Incorrect Default Permissions
Acrobat Reader <127.0.2651.105 OOB Write ACE
CVE-2024-41879
7.8 - High
- August 26, 2024
Acrobat Reader versions 127.0.2651.105 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Memory Corruption
Microsoft Edge HTML Memory Corruption CVE-2024-38207
CVE-2024-38207
6.3 - Medium
- August 23, 2024
Microsoft Edge (HTML-based) Memory Corruption Vulnerability
Memory Corruption
Microsoft Edge for Android URL Spoofing Vulnerability (CVE-2024-38208)
CVE-2024-38208
6.1 - Medium
- August 22, 2024
Microsoft Edge for Android Spoofing Vulnerability
XSS
Microsoft Edge Chromium RCE via Network Service Exposure
CVE-2024-38210
7.8 - High
- August 22, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Out-of-bounds Read
Microsoft Edge Chromium RCE Vulnerability
CVE-2024-38209
7.8 - High
- August 22, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Object Type Confusion
High CVE-2024-7971: Type Confusion in V8 before 128.0.6613.84 (Google Chrome)
CVE-2024-7971
8.8 - High
- August 21, 2024
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Object Type Confusion
Edge Chromium Elevation of Privilege via Browser Exploit
CVE-2024-43472
8.3 - High
- August 16, 2024
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Dangling pointer
Microsoft Edge HTML Memory Corruption Vulnerability
CVE-2024-38218
7.8 - High
- August 12, 2024
Microsoft Edge (HTML-based) Memory Corruption Vulnerability
Memory Corruption
Microsoft Edge (Chromium) RCE via Remote Code Execution
CVE-2024-38219
9 - Critical
- August 12, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Object Type Confusion
Jul 2024: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2024-38103
5.9 - Medium
- July 25, 2024
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Privacy violation
Jul 2024: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-38156
6.1 - Medium
- July 19, 2024
Microsoft Edge (Chromium-based) Spoofing Vulnerability
XSS
Jun 2024: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-38082
4.7 - Medium
- June 20, 2024
Microsoft Edge (Chromium-based) Spoofing Vulnerability
User Interface (UI) Misrepresentation of Critical Information
Jun 2024: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-38093
4.3 - Medium
- June 20, 2024
Microsoft Edge (Chromium-based) Spoofing Vulnerability
User Interface (UI) Misrepresentation of Critical Information
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Microsoft Edge Browser or by Microsoft? Click the Watch button to subscribe.
