Microsoft Edge Browser Web Browser based on Chromium
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Microsoft Edge Browser.
Recent Microsoft Edge Browser Security Advisories
| Advisory | Title | Published |
|---|---|---|
| CVE-2025-60711 | CVE-2025-60711 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | October 31, 2025 |
| CVE-2025-59251 | CVE-2025-59251 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | September 25, 2025 |
| CVE-2025-47967 | CVE-2025-47967 Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability | September 16, 2025 |
| CVE-2025-53791 | CVE-2025-53791 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability | September 6, 2025 |
| CVE-2025-49736 | CVE-2025-49736 Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability | August 12, 2025 |
| CVE-2025-49755 | CVE-2025-49755 Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability | August 12, 2025 |
| CVE-2025-49713 | CVE-2025-49713 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | July 2, 2025 |
| CVE-2025-49741 | CVE-2025-49741 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability | July 2, 2025 |
| CVE-2025-47963 | CVE-2025-47963 Microsoft Edge (Chromium-based) Spoofing Vulnerability | June 26, 2025 |
| CVE-2025-47964 | CVE-2025-47964 Microsoft Edge (Chromium-based) Spoofing Vulnerability | June 26, 2025 |
Known Exploited Microsoft Edge Browser Vulnerabilities
The following Microsoft Edge Browser vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Microsoft Edge Memory Corruption Vulnerability |
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. CVE-2016-7201 Exploit Probability: 90.1% |
March 28, 2022 |
| Microsoft Edge Memory Corruption Vulnerability |
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. CVE-2016-7200 Exploit Probability: 89.4% |
March 28, 2022 |
Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.
By the Year
In 2025 there have been 21 vulnerabilities in Microsoft Edge Browser with an average score of 6.5 out of ten. Last year, in 2024 Edge Browser had 49 security vulnerabilities published. Right now, Edge Browser is on track to have less security vulnerabilities in 2025 than it did last year. However, the average CVE base score of the vulnerabilities in 2025 is greater by 0.29.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2025 | 21 | 6.46 |
| 2024 | 49 | 6.17 |
| 2023 | 17 | 5.61 |
| 2022 | 4 | 7.43 |
| 2021 | 30 | 7.65 |
| 2020 | 36 | 6.72 |
| 2019 | 74 | 7.02 |
| 2018 | 89 | 7.18 |
It may take a day or so for new Edge Browser vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Microsoft Edge Browser Security Vulnerabilities
Aug 2025: Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
CVE-2025-49736
4.3 - Medium
- August 12, 2025
The ui performs the wrong action in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
The UI Performs the Wrong Action
Aug 2025: Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
CVE-2025-49755
4.3 - Medium
- August 12, 2025
User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
User Interface (UI) Misrepresentation of Critical Information
Microsoft Edge Chromium Spoofing CVE-2025-47964
CVE-2025-47964
4.3 - Medium
- July 11, 2025
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Edge Chromium Type Confusion RCE
CVE-2025-49713
8.8 - High
- July 02, 2025
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Object Type Confusion
Microsoft Edge UI misrepresents critical data, enabling network spoofing
CVE-2025-29825
6.5 - Medium
- May 02, 2025
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
User Interface (UI) Misrepresentation of Critical Information
CVE-2025-29834: OOB Read in MS Edge (Chromium) Enables Remote Code Exec
CVE-2025-29834
7.5 - High
- April 12, 2025
Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Out-of-bounds Read
Use-After-Free in Microsoft Edge (Chromium) Enables Network Code Exec
CVE-2025-29815
7.6 - High
- April 04, 2025
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
Dangling pointer
Microsoft Edge (Chromium) Type Confusion RCE
CVE-2025-25000
8.8 - High
- April 04, 2025
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Object Type Confusion
Edge iOS UI Misrepresentation Enables Network Spoofing
CVE-2025-29796
4.7 - Medium
- April 04, 2025
User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
User Interface (UI) Misrepresentation of Critical Information
Microsoft Edge XSS leads to unauthorized spoofing
CVE-2025-25001
4.3 - Medium
- April 04, 2025
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
XSS
Microsoft Edge (Chromium) RCE via Network
CVE-2025-29806
6.5 - Medium
- March 23, 2025
No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Object Type Confusion
MS Edge LPE via Improper Link Resolution
CVE-2025-29795
7.8 - High
- March 23, 2025
Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
insecure temporary file
Edge Chromium UI Spoofing via Wrong Action
CVE-2025-26643
5.4 - Medium
- March 07, 2025
The UI performs the wrong action in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
The UI Performs the Wrong Action
Microsoft Edge (Chromium) Security Feature Bypass Vulnerability
CVE-2025-21401
4.5 - Medium
- February 15, 2025
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Open Redirect
Microsoft Edge Spoofing Vulnerability (CVE-2025-21253)
CVE-2025-21253
5.3 - Medium
- February 06, 2025
Microsoft Edge for IOS and Android Spoofing Vulnerability
User Interface (UI) Misrepresentation of Critical Information
Microsoft Edge (Chromium) Remote Code Execution Vulnerability
CVE-2025-21408
8.8 - High
- February 06, 2025
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Object Type Confusion
Edge RCE in Chromium-based Browser (CVE-2025-21342)
CVE-2025-21342
8.8 - High
- February 06, 2025
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Object Type Confusion
Microsoft Edge (Chromium) RCE Vulnerability
CVE-2025-21283
8.8 - High
- February 06, 2025
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Insufficient Granularity of Address Regions Protected by Register Locks
Microsoft Edge Chromium RCE Vulnerability
CVE-2025-21279
8.8 - High
- February 06, 2025
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Object Type Confusion
Microsoft Edge Chromium Spoofing Vulnerability CVE-2025-21267
CVE-2025-21267
4.4 - Medium
- February 06, 2025
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Improperly Implemented Security Check for Standard
Microsoft Edge Chromium UI Spoofing Vulnerability
CVE-2025-21262
5.4 - Medium
- January 24, 2025
User Interface (UI) Misrepresentation of Critical Information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network
User Interface (UI) Misrepresentation of Critical Information
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-49041
4.3 - Medium
- December 06, 2024
Microsoft Edge (Chromium-based) Spoofing Vulnerability
The UI Performs the Wrong Action
HttpRequest Header Encoding Flaw Enables Prototype Pollution in Edge JS
CVE-2024-42330
9.1 - Critical
- November 27, 2024
The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that can be used to access hidden properties of objects.
Use of Externally-Controlled Format String
Microsoft Edge (Chromium-based) Spoofing Vulnerability CVE-2024-49054
CVE-2024-49054
- November 22, 2024
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Insufficient UI Warning of Dangerous Operations
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2024-49025
4.3 - Medium
- November 14, 2024
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Privacy violation
Microsoft Edge (Chromium) Spoofing Vulnerability
CVE-2024-43577
4.3 - Medium
- October 18, 2024
Microsoft Edge (Chromium-based) Spoofing Vulnerability
The UI Performs the Wrong Action
Microsoft Edge Remote Code Execution via Chromium-based Vulnerability
CVE-2024-43566
9.8 - Critical
- October 17, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Integer Overflow or Wraparound
Microsoft Edge Chromium RCE Vulnerability CVE-2024-43579
CVE-2024-43579
8.3 - High
- October 17, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Heap-based Buffer Overflow
MS Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-43580
5.4 - Medium
- October 17, 2024
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Insufficient UI Warning of Dangerous Operations
Microsoft Edge Chromium RCE Vulnerability
CVE-2024-43587
8.1 - High
- October 17, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Heap-based Buffer Overflow
CVE-2024-43595 Microsoft Edge (Chromium) RCE via Remote Exploit
CVE-2024-43595
8.8 - High
- October 17, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft Edge Chromium RCE CVE-2024-43596
CVE-2024-43596
8.8 - High
- October 17, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Object Type Confusion
Spoofing Vulnerability in Microsoft Edge (Chromium)
CVE-2024-38221
4.3 - Medium
- September 19, 2024
Microsoft Edge (Chromium-based) Spoofing Vulnerability
XSS
Microsoft Edge (Chromium) RCE Vulnerability
CVE-2024-43496
8.8 - High
- September 19, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Memory Corruption
Microsoft Edge Chromium Info Disclosure CVE-2024-38222
CVE-2024-38222
6.5 - Medium
- September 12, 2024
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Incorrect Default Permissions
Acrobat Reader <127.0.2651.105 OOB Write ACE
CVE-2024-41879
7.8 - High
- August 26, 2024
Acrobat Reader versions 127.0.2651.105 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Memory Corruption
Microsoft Edge HTML Memory Corruption CVE-2024-38207
CVE-2024-38207
6.3 - Medium
- August 23, 2024
Microsoft Edge (HTML-based) Memory Corruption Vulnerability
Memory Corruption
Microsoft Edge Chromium RCE via Network Service Exposure
CVE-2024-38210
7.8 - High
- August 22, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Out-of-bounds Read
Microsoft Edge Chromium RCE Vulnerability
CVE-2024-38209
7.8 - High
- August 22, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Object Type Confusion
Microsoft Edge for Android URL Spoofing Vulnerability (CVE-2024-38208)
CVE-2024-38208
6.1 - Medium
- August 22, 2024
Microsoft Edge for Android Spoofing Vulnerability
XSS
High CVE-2024-7971: Type Confusion in V8 before 128.0.6613.84 (Google Chrome)
CVE-2024-7971
8.8 - High
- August 21, 2024
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Object Type Confusion
Edge Chromium Elevation of Privilege via Browser Exploit
CVE-2024-43472
8.3 - High
- August 16, 2024
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Dangling pointer
Microsoft Edge (Chromium) RCE via Remote Code Execution
CVE-2024-38219
9 - Critical
- August 12, 2024
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Object Type Confusion
Microsoft Edge HTML Memory Corruption Vulnerability
CVE-2024-38218
7.8 - High
- August 12, 2024
Microsoft Edge (HTML-based) Memory Corruption Vulnerability
Memory Corruption
Jul 2024: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2024-38103
5.9 - Medium
- July 25, 2024
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Privacy violation
Jul 2024: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-38156
6.1 - Medium
- July 19, 2024
Microsoft Edge (Chromium-based) Spoofing Vulnerability
XSS
Microsoft Edge Spoofing Vulnerability
CVE-2024-38082
4.7 - Medium
- June 20, 2024
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge Chromium Spoofing Vulnerability (CVE-2024-38093)
CVE-2024-38093
4.3 - Medium
- June 20, 2024
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge for iOS Spoofing Vulnerability CVE-2024-30057
CVE-2024-30057
5.4 - Medium
- June 13, 2024
Microsoft Edge for iOS Spoofing Vulnerability
Microsoft Edge (Chromium) Spoofing Vulnerability
CVE-2024-38083
4.3 - Medium
- June 13, 2024
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Microsoft Edge Browser or by Microsoft? Click the Watch button to subscribe.
