Loading story…
The Canadian Centre for Cyber Security issued advisory AV26-143 urging organizations to update Microsoft Edge Stable to remediate vulnerabilities affecting versions prior to 145.0.3800.58. Microsoft indicated that CVE-2026-2441 has an available exploit, increasing the likelihood of active or imminent abuse, and the advisory directs administrators to apply Microsoft’s February 2026 Edge security update.
In parallel, Microsoft began rolling out Edge 145 to the Stable channel with multiple enterprise security enhancements, including expanded data protection for Edge for Business (cross-tenant Intune App Protection Policies, DLP controls such as clipboard limits, watermarks, protected downloads, and leak controls for screenshots and developer tools). The release also adds stronger extension governance (detection/revocation of malicious sideloaded extensions and extension monitoring via the Edge management service) and improvements to password handling via a password affiliation service for related domains—changes that complement the security posture improvements delivered alongside the security fixes in the Edge 145 line.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-143 warning that Microsoft had released an Edge security update and urging users and administrators to review Microsoft's release notes and apply the update. The notice highlighted that the update fixed vulnerabilities affecting versions before 145.0.3800.58.
Microsoft rolled out Edge 145 to the Stable channel in a phased deployment, adding enterprise-focused protections such as expanded Edge for Business data protection, watermarking, protected clipboard controls, OneDrive for Business download redirection, and stronger extension security monitoring. The release also introduced administrative controls for profile editing, web app installation, and oversight of AI-generated application execution via Safe Hosting extension policy.
Microsoft published a security update for the Microsoft Edge Stable Channel on February 14, 2026, addressing vulnerabilities in versions prior to 145.0.3800.58. Microsoft indicated that an exploit was available for CVE-2026-2441.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released security updates for **Microsoft Edge Stable Channel** to fix multiple vulnerabilities affecting earlier browser builds. One update covered versions prior to **`146.0.3856.72`**, and a later release addressed additional flaws in versions prior to **`147.0.3912.60`**. The advisories were highlighted by the Canadian Centre for Cyber Security, which said the fixes apply to Edge Stable Channel deployments exposed by outdated versions. The Canadian Centre for Cyber Security urged users and administrators to review Microsoft's release notes and deploy the updated Edge builds as soon as possible. Organizations running Edge Stable Channel versions below the patched releases were advised to update promptly to reduce exposure to known browser vulnerabilities.
Jun 29, 2026
Microsoft disclosed security vulnerabilities affecting **Microsoft Edge (Chromium-based)**, with the Canadian Centre for Cyber Security warning that versions prior to **`150.0.4078.99`** are impacted. The advisory directs organizations to consult Microsoft's **Security Update Guide** for vulnerability details and remediation information tied to the affected browser release. Government and industry notices amplified the advisory and urged users and administrators to apply relevant Edge updates as they become available. The guidance highlights the need for prompt patching across enterprise environments running outdated Edge installations to reduce exposure to the disclosed flaws.
Jul 27, 2026
Microsoft disclosed **CVE-2026-42838**, an elevation of privilege flaw in Chromium-based **Microsoft Edge** caused by improper neutralization of special elements in output used by a downstream component (`CWE-74`). The company rated the issue **Moderate** with a **CVSS 3.1 score of 5.4**, stating that exploitation requires user interaction, can be launched over the network with low attack complexity, and would give an attacker the same rights as the user running the browser. Microsoft said the vulnerability was **not publicly disclosed**, **not exploited in the wild**, and **less likely to be exploited** at the time of publication. A fix was released in **Microsoft Edge version 148.0.3967.55**, based on **Chromium 148.0.7778.97**. The disclosure follows a long pattern of Microsoft Edge privilege-escalation advisories, including earlier CVEs such as `CVE-2022-26895`, `CVE-2022-23262`, `CVE-2022-26908`, `CVE-2022-26894`, `CVE-2022-26900`, `CVE-2022-44708`, `CVE-2022-21954`, `CVE-2022-21970`, `CVE-2021-34475`, `CVE-2022-33680`, and `CVE-2022-26909`, underscoring the recurring need to keep Edge updated to the latest security release.
Jun 29, 2026