Multiple Vulnerabilities Discovered in Microsoft Edge – Immediate Patch Required

Microsoft Edge has been found to contain a set of 30+ CVEs that allow attackers to trigger unspecified security issues. The vulnerabilities affect all supported Edge releases on Windows, macOS, and Linux, and can be exploited via crafted web content or malicious extensions.

What happened

On 30 September 2026 Microsoft released a security bulletin detailing 30 CVEs (CVE-2026-85047, CVE-2026-87438, CVE-2026-87464, …, CVE-2026-87643). The flaws are primarily memory corruption and privilege escalation bugs that can be triggered by a malicious website or extension.

Impact

• Potential arbitrary code execution in the browser process.
• Privilege escalation to the user account or higher.
• Data exfiltration or session hijacking via compromised browser context.

What to do

• Immediately update Microsoft Edge to the latest version (Edge 118.x or later). Microsoft has released patches for all listed CVEs.
• Verify that the browser version is at least 118.0.1902.104 on Windows, 118.0.1902.104 on macOS, and 118.0.1902.104 on Linux.
• Disable or remove any untrusted extensions that could be used to deliver malicious payloads.
• Enable Microsoft Defender SmartScreen and other anti-phishing protections.
• Monitor browser logs for anomalous memory access or crash events.

Additional Mitigations

Microsoft recommends disabling the “Allow sites to run background tasks” setting and enforcing a strict Content Security Policy on internal sites to reduce the attack surface.