Loading vulnerability…
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2025-49741 is an information disclosure vulnerability in Microsoft Edge (Chromium-based). Microsoft describes the issue at a high level as allowing an unauthorized attacker to disclose information over a network. Available authoritative details indicate network attackability, low attack complexity, no privileges required, and required user interaction. The affected product is Chromium-based Microsoft Edge, and Microsoft provided an official fix in Edge version 135.0.3179.98, released on 2025-04-25. Additional third-party claims in the supplied content about specific middleware header handling and x-middleware-subrequest validation are inconsistent with the Microsoft advisory context and are not sufficiently reliable to attribute as the vulnerable mechanism.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in unauthorized disclosure of information from the affected Edge security context. Microsoft’s CVSS data indicates high confidentiality impact, with no integrity or availability impact. The scope is changed, suggesting the disclosure may cross a security boundary or expose data beyond the initially compromised component’s normal authorization context.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting user interaction with untrusted web content and enforcing browser update compliance as quickly as possible. Because exploitation requires user interaction and occurs over the network, interim risk reduction can include restricting access to untrusted sites, applying web filtering, and using enterprise controls that minimize exposure to malicious or attacker-controlled content. No vendor-specific workaround beyond applying the official fix is provided in the supplied content.
Patch, then assume compromise.
Upgrade Microsoft Edge (Chromium-based) to version 135.0.3179.98 or later. Microsoft identifies this release, based on Chromium 135.0.7049.114/.115, as the official fix for CVE-2025-49741. Standard remediation is to deploy the vendor-provided Edge security update across affected endpoints through enterprise software distribution, browser auto-update, or other managed patching workflows.
No validated public exploits yet. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.