Loading story…
Microsoft Edge users were urged to update Stable Channel installations to version 146.0.3856.59 or later after CVE-2026-3910 was disclosed as having an available exploit and being actively exploited in the wild. Advisory details indicate the flaw can allow arbitrary code execution inside a sandbox through a crafted HTML page, and additional Edge vulnerabilities may also enable spoofing, remote code execution, and security restriction bypass. HKCERT rated the Edge issue as Extremely High Risk, underscoring the urgency of patching.
A separate advisory for Google Chrome addressed CVE-2026-3909 in Chrome versions prior to 146.0.7680.80, and CISA added that Chrome flaw to the Known Exploited Vulnerabilities catalog. Although both browser advisories were published the same day and concern actively exploited Chromium-based browser vulnerabilities, the Chrome item concerns a different CVE and a different vendor advisory and should be treated as a separate incident from the Edge-specific CVE-2026-3910 disclosure.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
By 2026-03-16, government and CERT advisories warned that the Microsoft Edge update addressed CVE-2026-3910, a remote code execution vulnerability for which Microsoft indicated an exploit is available. Users and administrators were urged to review Microsoft's release notes and apply the update.
On 2026-03-13, Microsoft released a security update for Microsoft Edge Stable Channel addressing vulnerabilities in versions prior to 146.0.3856.59. The advisories indicate the update remediates multiple security issues affecting Edge.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
hkcert.org
Open sourcehkcert.org
Open sourcecyber.gc.ca
Open sourcehkcert.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google patched **CVE-2026-85046**, a high-severity type-confusion vulnerability in the Chromium V8 JavaScript and WebAssembly engine that is under active exploitation. A maliciously crafted webpage can trigger arbitrary code execution within the browser sandbox when visited. The issue affects Google Chrome versions earlier than `152.0.7977.82` and extends to Chromium-based browsers, including Microsoft Edge, Brave, and Opera; CISA added the flaw to its Known Exploited Vulnerabilities catalog. Microsoft Edge also received fixes for multiple Chromium-derived vulnerabilities, including sandboxed and sandbox-escape code-execution flaws, an access-restriction bypass, and a V8 out-of-bounds write. Organizations should urgently update Chrome to `152.0.7977.82` or later and Edge on Windows to `152.0.4191.66` or later, while validating and patching other deployed Chromium-based browsers against their vendors' fixed releases.
Sep 15, 2026
Microsoft has issued security advisories for a long-running series of **remote code execution** vulnerabilities affecting **Microsoft Edge (Chromium-based)**, with disclosures spanning multiple product update cycles. The referenced flaws include `CVE-2021-43221`, `CVE-2022-21929`, `CVE-2022-33636`, `CVE-2022-38012`, `CVE-2023-21775`, `CVE-2023-36008`, `CVE-2023-36022`, `CVE-2023-36034`, `CVE-2024-38210`, `CVE-2024-38219`, `CVE-2024-43496`, `CVE-2024-43578`, `CVE-2024-43596`, `CVE-2024-49023`, `CVE-2025-21408`, `CVE-2025-25000`, `CVE-2025-29834`, and `CVE-2025-60711`, all tracked by Microsoft as Edge RCE issues. The advisories indicate continued patching of browser-exposed attack surface in Edge, including several clusters of RCE fixes released on the same day, suggesting bundled security updates across versions. While the entries provided do not include technical synopses or exploitation details, the repeated publication of Edge RCE bulletins through Microsoft Update Guide and MSRC portal pages shows sustained remediation activity for code-execution bugs that could be triggered through malicious web content or browser processing components, reinforcing the need for rapid browser update deployment across enterprise fleets.
Jul 12, 2026
Microsoft Edge users faced a series of serious vulnerabilities spanning remote code execution, information disclosure, and legacy browser compatibility risks. Reported issues included `CVE-2025-59251`, an Edge remote code execution flaw with limited public technical detail; `CVE-2025-29834`, an out-of-bounds read in the V8 JavaScript engine affecting versions before `135.0.2789.91`; and `CVE-2025-49713`, a type confusion bug in V8 that reportedly enabled in-the-wild exploitation against Edge versions before `138.0.3351.65`. Separately, `CVE-2025-49741` was described as an information disclosure issue tied to improper validation of the `x-middleware-subrequest` HTTP header, potentially exposing cached data and session tokens in versions before `137.0.3296.62`. The disclosures also highlighted risk beyond standard browsing sessions. `CVE-2025-30397` affected Microsoft’s Scripting Engine when Edge was used in Internet Explorer Mode, creating an actively exploited path to remote code execution on Windows 10 and Windows 11 systems that still depend on legacy web applications. Microsoft issued updates across the affected products, while defenders were urged to prioritize browser patching, review exposure in Chromium-based deployments, harden JavaScript and web-content controls, and reduce or disable IE Mode where operationally possible. A new advisory from HKCERT on multiple Microsoft Edge vulnerabilities underscores the continuing volume of security issues affecting the browser.
Jun 29, 2026