Loading vulnerability…
Out-of-bounds Read RCE in Microsoft Edge (Chromium-based)
CVE-2025-29834 is an out-of-bounds read vulnerability in Microsoft Edge (Chromium-based) affecting versions prior to 134.0.3124.93. The flaw allows an unauthorized attacker to execute arbitrary code remotely by exploiting improper memory access, likely via crafted web content. The vulnerability is classified under CWE-125 and requires user interaction for successful exploitation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows remote code execution with the privileges of the user running Edge, impacting confidentiality, integrity, and availability. The attack is network-based, requires no privileges, but does require user interaction (e.g., visiting a malicious website). The CVSS score is 7.5, indicating high severity.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict access to untrusted websites, educate users to avoid suspicious links, and consider deploying browser security controls or sandboxing to limit the impact of exploitation. Monitor for vendor updates and apply security patches as soon as they become available.
Patch, then assume compromise.
Upgrade Microsoft Edge (Chromium-based) to version 134.0.3124.93 or later, as this version contains the vendor-supplied fix for the vulnerability. Follow Microsoft's official advisory for patch deployment.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.