Microsoft Edge Chromium
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Microsoft Edge Chromium.
By the Year
In 2026 there have been 114 vulnerabilities in Microsoft Edge Chromium with an average score of 7.0 out of ten. Last year, in 2025 Edge Chromium had 26 security vulnerabilities published. That is, 88 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.59.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 114 | 7.05 |
| 2025 | 26 | 6.46 |
| 2024 | 50 | 6.05 |
| 2023 | 58 | 6.67 |
| 2022 | 34 | 7.14 |
| 2021 | 53 | 7.26 |
| 2020 | 3 | 5.37 |
It may take a day or so for new Edge Chromium vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Microsoft Edge Chromium Security Vulnerabilities
Oct 2026: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2026-69446
4.4 - Medium
- October 30, 2026
Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
AuthZ
Oct 2026: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-88078
4.3 - Medium
- October 29, 2026
Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Improper Verification of Cryptographic Signature
Oct 2026: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2026-88077
8.8 - High
- October 29, 2026
Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
Integer Overflow or Wraparound
Oct 2026: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2026-96196
8.8 - High
- October 29, 2026
Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
Denylist / Deny List
Oct 2026: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2026-96187
7.4 - High
- October 29, 2026
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
Object Type Confusion
Oct 2026: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2026-85899
8.1 - High
- October 29, 2026
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.
Dangling pointer
Oct 2026: Microsoft Edge for Android Security Feature Bypass Vulnerability
CVE-2026-85330
4.3 - Medium
- October 29, 2026
Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.
AuthZ
Oct 2026: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2026-88090
5.4 - Medium
- October 29, 2026
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
Object Type Confusion
Oct 2026: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-20942
4.3 - Medium
- October 29, 2026
Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Clickjacking
Oct 2026: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2026-96203
8.8 - High
- October 29, 2026
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
Dangling pointer
Oct 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-96192
8.8 - High
- October 29, 2026
Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.
Dangling pointer
Oct 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-96199
8.8 - High
- October 29, 2026
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Heap-based Buffer Overflow
Oct 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-96198
8.8 - High
- October 29, 2026
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Heap-based Buffer Overflow
Oct 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-85897
8.8 - High
- October 29, 2026
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Heap-based Buffer Overflow
Oct 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-85890
8.8 - High
- October 29, 2026
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Double-free
Oct 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-62765
7.5 - High
- October 27, 2026
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Object Type Confusion
Oct 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-85898
8.8 - High
- October 27, 2026
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Object Type Confusion
Oct 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-83831
8.8 - High
- October 27, 2026
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Double-free
Oct 2026: Windows Shell Security Feature Bypass Vulnerability
CVE-2026-96951
8.8 - High
- October 13, 2026
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Command Injection
Oct 2026: Windows Raw Image Extension Remote Code Execution Vulnerability
CVE-2026-96202
8.8 - High
- October 13, 2026
Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
Heap-based Buffer Overflow
Oct 2026: Azure Storage Library Elevation of Privilege Vulnerability
CVE-2026-88094
8.1 - High
- October 13, 2026
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges over a network.
Injection
Sep 2026: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2026-88097
8.1 - High
- September 18, 2026
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.
Dangling pointer
Sep 2026: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2026-85893
8.8 - High
- September 15, 2026
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Dangling pointer
Sep 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-69486
8.8 - High
- September 15, 2026
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Heap-based Buffer Overflow
Sep 2026: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2026-85892
7.8 - High
- September 14, 2026
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
Race Condition
Sep 2026: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-77490
6.1 - Medium
- September 11, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
XSS
Sep 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-70341
8.5 - High
- September 11, 2026
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
Dangling pointer
Aug 2026: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2026-70309
5.4 - Medium
- August 28, 2026
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
Origin Validation Error
Aug 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-72984
8.8 - High
- August 28, 2026
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Object Type Confusion
Aug 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-66798
4.3 - Medium
- August 28, 2026
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Dangling pointer
Aug 2026: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-66324
6.5 - Medium
- August 28, 2026
External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
External Control of File Name or Path
Aug 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-66323
5.4 - Medium
- August 28, 2026
Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Improper Neutralization of Parameter/Argument Delimiters
Aug 2026: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2026-62904
5.4 - Medium
- August 28, 2026
Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
AuthZ
Aug 2026: Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability
CVE-2026-58616
4.4 - Medium
- August 28, 2026
Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to disclose information over a network.
Race Condition
Aug 2026: Microsoft Edge for iOS Spoofing Vulnerability
CVE-2026-70331
5.4 - Medium
- August 28, 2026
Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
1427
Aug 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-72970
8.3 - High
- August 14, 2026
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Heap-based Buffer Overflow
Aug 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-70339
5.4 - Medium
- August 11, 2026
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Object Type Confusion
Aug 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-66326
6.5 - Medium
- August 03, 2026
Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
AuthZ
Aug 2026: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-66325
6.1 - Medium
- August 03, 2026
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
SSRF
Aug 2026: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-66322
7.1 - High
- August 03, 2026
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Origin Validation Error
Aug 2026: Microsoft Edge (Chromium-based) Tampering Vulnerability
CVE-2026-66317
5.4 - Medium
- August 03, 2026
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.
Origin Validation Error
Aug 2026: Microsoft Edge (Chromium-based) Tampering Vulnerability
CVE-2026-66311
6.2 - Medium
- August 03, 2026
Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.
AuthZ
Aug 2026: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-65804
6.1 - Medium
- August 03, 2026
Improper control of generation of code ('code injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Code Injection
Aug 2026: Microsoft Edge for Android Information Disclosure Vulnerability
CVE-2026-65802
7.4 - High
- August 03, 2026
External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.
External Control of File Name or Path
Aug 2026: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-66316
5.4 - Medium
- August 03, 2026
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Origin Validation Error
Aug 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-66315
7.5 - High
- August 03, 2026
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Dangling pointer
Aug 2026: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2026-66314
6.5 - Medium
- August 03, 2026
Time-of-check time-of-use (toctou) race condition in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
TOCTTOU
Aug 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-66312
6.5 - Medium
- August 03, 2026
Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
Buffer Over-read
Aug 2026: Microsoft Edge (Chromium-based) Tampering Vulnerability
CVE-2026-66313
6.8 - Medium
- August 03, 2026
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.
Origin Validation Error
Aug 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-66321
7.4 - High
- August 03, 2026
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Object Type Confusion
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Microsoft Edge Chromium or by Microsoft? Click the Watch button to subscribe.
