Loading story…
Microsoft Edge 146 introduced a set of browser and enterprise security-related changes, including revised password handling, expanded privacy protections, and new controls for local network access. Microsoft removed passwords from the Clear Browsing Data menu so saved credentials are no longer deleted through routine browser data clearing, while also deprecating the browser’s custom primary password feature in favor of device-based authentication. The release also expands Private IP protections within Edge Secure Network, routing traffic from known trackers through Microsoft infrastructure to reduce IP-based tracking, and changes InPrivate browsing so it now uses the same tracking prevention level as standard browsing sessions.
For managed environments, Edge 146 adds Local Network Access (LNA) policies that let administrators define trusted IP ranges and control which websites can reach local network devices, alongside new options to prefer specific TLS cipher suites and key exchange algorithms. Outside the security controls, Microsoft is also retiring Collections, migrating Workspaces from OneDrive and SharePoint to the Edge Sync service while removing collaboration features, and ending support for macOS 12 Monterey after Edge 150. The release also includes upstream Chromium security fixes, making Edge 146 a mix of platform hardening, privacy updates, and product deprecations rather than a standalone incident or vulnerability disclosure.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft said that support for macOS 12 Monterey will end after Edge 150, and that Edge 151 will require macOS 13 Ventura or later. This platform support change was disclosed alongside Edge 146 coverage.
With the Edge 146 release, Microsoft removed saved passwords from the Clear Browsing Data interface, began retiring Collections, deprecated custom primary passwords in favor of device authentication, and continued migrating Workspaces to the Edge Sync service while removing sharing and collaboration features.
On 2026-03-13, Microsoft released Edge version 146 Stable. The update added expanded IP privacy protections in Edge Secure Network, new Local Network Access policies, TLS cipher and key exchange controls, and incorporated Chromium security fixes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Canadian Centre for Cyber Security issued advisory **AV26-143** urging organizations to update **Microsoft Edge Stable** to remediate vulnerabilities affecting versions prior to `145.0.3800.58`. Microsoft indicated that **CVE-2026-2441** has an **available exploit**, increasing the likelihood of active or imminent abuse, and the advisory directs administrators to apply Microsoft’s February 2026 Edge security update. In parallel, Microsoft began rolling out **Edge 145** to the Stable channel with multiple enterprise security enhancements, including expanded data protection for *Edge for Business* (cross-tenant **Intune App Protection Policies**, DLP controls such as clipboard limits, watermarks, protected downloads, and leak controls for screenshots and developer tools). The release also adds stronger extension governance (detection/revocation of **malicious sideloaded extensions** and extension monitoring via the Edge management service) and improvements to password handling via a password affiliation service for related domains—changes that complement the security posture improvements delivered alongside the security fixes in the Edge 145 line.
Jun 29, 2026
Microsoft published security advisories for a broad set of Chromium vulnerabilities affecting its browser platform, including `CVE-2026-7344` (use-after-free in Accessibility), `CVE-2026-7341` (use-after-free in WebRTC), `CVE-2026-7353` (heap buffer overflow in Skia), and `CVE-2026-7337` (type confusion in V8). Additional flaws patched include use-after-free bugs in Views, Media, GPU, Cast, and Navigation, along with insufficient validation of untrusted input in Compositing and an inappropriate implementation issue in Tint. The volume and variety of bugs indicate a significant browser security update focused on memory-safety and input-handling weaknesses in Chromium components commonly exposed through web content. Microsoft also listed `CVE-2026-31682`, a separate issue tied to `br_nd_send` and Neighbor Discovery option parsing, but the main body of advisories centers on Chromium-derived fixes that organizations should prioritize across Microsoft Edge deployments to reduce risk from malicious websites and crafted content.
Jul 12, 2026
Microsoft disclosed **CVE-2026-42838**, an elevation of privilege flaw in Chromium-based **Microsoft Edge** caused by improper neutralization of special elements in output used by a downstream component (`CWE-74`). The company rated the issue **Moderate** with a **CVSS 3.1 score of 5.4**, stating that exploitation requires user interaction, can be launched over the network with low attack complexity, and would give an attacker the same rights as the user running the browser. Microsoft said the vulnerability was **not publicly disclosed**, **not exploited in the wild**, and **less likely to be exploited** at the time of publication. A fix was released in **Microsoft Edge version 148.0.3967.55**, based on **Chromium 148.0.7778.97**. The disclosure follows a long pattern of Microsoft Edge privilege-escalation advisories, including earlier CVEs such as `CVE-2022-26895`, `CVE-2022-23262`, `CVE-2022-26908`, `CVE-2022-26894`, `CVE-2022-26900`, `CVE-2022-44708`, `CVE-2022-21954`, `CVE-2022-21970`, `CVE-2021-34475`, `CVE-2022-33680`, and `CVE-2022-26909`, underscoring the recurring need to keep Edge updated to the latest security release.
Jun 29, 2026