Microsoft Edge Chromium vulnerabilities
290 known vulnerabilities affecting microsoft/edge_chromium.
Total CVEs
290
CISA KEV
9
actively exploited
Public exploits
10
Exploited in wild
9
Severity breakdown
CRITICAL14HIGH141MEDIUM127LOW8
Vulnerabilities
Page 2 of 15
CVE-2026-70341P2HIGHCVSS 8.8fixed in 152.0.4191.522026-09-11
CVE-2026-70341 [HIGH] CWE-416 CVE-2026-70341: Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
nvd
CVE-2026-66312P2HIGHCVSS 8.8fixed in 151.0.4129.592026-08-04
CVE-2026-66312 [HIGH] CWE-126 CVE-2026-66312: Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code ov
Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
nvd
CVE-2024-38219P3CRITICALCVSS 9.0fixed in 127.0.2651.982024-08-12
CVE-2024-38219 [CRITICAL] CWE-843 CVE-2024-38219: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
nvd
CVE-2026-66326P3HIGHCVSS 8.8fixed in 151.0.4129.592026-08-04
CVE-2026-66326 [HIGH] CWE-862 CVE-2026-66326: Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute
Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-57985P3HIGHCVSS 8.8fixed in 150.0.4078.482026-07-03
CVE-2026-57985 [HIGH] CWE-20 CVE-2026-57985: Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to exec
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-50521P3HIGHCVSS 8.3fixed in 149.0.4022.672026-07-01
CVE-2026-50521 [HIGH] CWE-416 CVE-2026-50521: Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
nvd
CVE-2021-21121P3CRITICALCVSS 9.6fixed in 88.0.705.502021-02-09
CVE-2021-21121 [CRITICAL] CWE-416 CVE-2021-21121: Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker
Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
nvd
CVE-2026-72984P3HIGHCVSS 8.8fixed in 152.0.4191.532026-08-28
CVE-2026-72984 [HIGH] CWE-843 CVE-2026-72984: Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) all
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-21279P3HIGHCVSS 8.8fixed in 133.0.3065.512025-02-06
CVE-2025-21279 [HIGH] CWE-843 CVE-2025-21279: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
nvd
CVE-2026-69486P3HIGHCVSS 8.8fixed in 153.0.4234.322026-09-15
CVE-2026-69486 [HIGH] CWE-122 CVE-2026-69486: Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to exe
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-56645P3HIGHCVSS 8.8fixed in 150.0.4078.482026-07-03
CVE-2026-56645 [HIGH] CWE-122 CVE-2026-56645: Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to exe
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-57981P3HIGHCVSS 8.8fixed in 150.0.4078.482026-07-03
CVE-2026-57981 [HIGH] CWE-416 CVE-2026-57981: Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code ov
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-21283P3HIGHCVSS 8.8fixed in 133.0.3065.512025-02-06
CVE-2025-21283 [HIGH] CWE-1222 CVE-2025-21283: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
nvd
CVE-2025-21408P3HIGHCVSS 8.8fixed in 133.0.3065.512025-02-06
CVE-2025-21408 [HIGH] CWE-843 CVE-2025-21408: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
nvd
CVE-2025-21342P3HIGHCVSS 8.8fixed in 133.0.3065.512025-02-06
CVE-2025-21342 [HIGH] CWE-843 CVE-2025-21342: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
nvd
CVE-2026-85893P3HIGHCVSS 8.8fixed in 153.0.4234.322026-09-15
CVE-2026-85893 [HIGH] CWE-416 CVE-2026-85893: Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privile
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
nvd
CVE-2026-57974P3HIGHCVSS 8.8fixed in 150.0.4078.482026-07-03
CVE-2026-57974 [HIGH] CWE-190 CVE-2026-57974: Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to
Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2023-35618P3CRITICALCVSS 9.6fixed in 120.0.2210.612023-12-07
CVE-2023-35618 [CRITICAL] CWE-416 CVE-2023-35618: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
nvd
CVE-2021-21124P3CRITICALCVSS 9.6fixed in 88.0.705.502021-02-09
CVE-2021-21124 [CRITICAL] CWE-416 CVE-2021-21124: Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 all
Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
nvd
CVE-2021-21157P3HIGHCVSS 8.8fixed in 88.0.4324.1822021-02-22
CVE-2021-21157 [HIGH] CWE-416 CVE-2021-21157: Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote atta
Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
nvd