Multiple Microsoft Edge Flaws Expose Users to RCE, Data Theft, and IE Mode Attacks

Microsoft Edge users faced a series of serious vulnerabilities spanning remote code execution, information disclosure, and legacy browser compatibility risks. Reported issues included CVE-2025-59251, an Edge remote code execution flaw with limited public technical detail; CVE-2025-29834, an out-of-bounds read in the V8 JavaScript engine affecting versions before 135.0.2789.91; and CVE-2025-49713, a type confusion bug in V8 that reportedly enabled in-the-wild exploitation against Edge versions before 138.0.3351.65. Separately, CVE-2025-49741 was described as an information disclosure issue tied to improper validation of the x-middleware-subrequest HTTP header, potentially exposing cached data and session tokens in versions before 137.0.3296.62.

The disclosures also highlighted risk beyond standard browsing sessions. CVE-2025-30397 affected Microsoft’s Scripting Engine when Edge was used in Internet Explorer Mode, creating an actively exploited path to remote code execution on Windows 10 and Windows 11 systems that still depend on legacy web applications. Microsoft issued updates across the affected products, while defenders were urged to prioritize browser patching, review exposure in Chromium-based deployments, harden JavaScript and web-content controls, and reduce or disable IE Mode where operationally possible. A new advisory from HKCERT on multiple Microsoft Edge vulnerabilities underscores the continuing volume of security issues affecting the browser.