Microsoft Edge vulnerabilities

760 CVEs affecting Microsoft Edge, 12 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-70341, published 2026-09-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-0313: Adobe Flash Player Use-After-Free Vulnerability, published 2015-02-02. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-13. EPSS: 95.3% chance of exploitation in the next 30 days. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute…
CVE-2015-0311: Adobe Flash Player Remote Code Execution Vulnerability, published 2015-01-23. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-13. EPSS: 85.6% chance of exploitation in the next 30 days. Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute…
CVE-2016-7200: Microsoft Edge Memory Corruption Vulnerability, published 2016-11-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 82.8% chance of exploitation in the next 30 days. The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting…
CVE-2021-26411: Microsoft Internet Explorer Memory Corruption Vulnerability, published 2021-03-11. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 80.8% chance of exploitation in the next 30 days. Internet Explorer Memory Corruption Vulnerability
CVE-2017-0037: Microsoft Edge and Internet Explorer Type Confusion Vulnerability, published 2017-02-26. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 80.4% chance of exploitation in the next 30 days. Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which…
CVE-2016-7201: Microsoft Edge Memory Corruption Vulnerability, published 2016-11-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 80% chance of exploitation in the next 30 days. The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting…
CVE-2023-5217: Google Chromium libvpx Heap Buffer Overflow Vulnerability, published 2023-09-28. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2023-10-02. EPSS: 49% chance of exploitation in the next 30 days. Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
CVE-2020-16009: Google Chromium V8 Type Confusion Vulnerability, published 2020-11-03. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 48.3% chance of exploitation in the next 30 days. Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2022-4135: Google Chromium GPU Heap Buffer Overflow Vulnerability, published 2022-11-25. Critical severity, CVSS 9.6. Actively exploited: in CISA KEV since 2022-11-28. EPSS: 31.9% chance of exploitation in the next 30 days. Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML…
CVE-2016-3351: Microsoft Internet Explorer and Edge Information Disclosure Vulnerability, published 2016-09-14. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2022-05-24. EPSS: 26.5% chance of exploitation in the next 30 days. Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."

Latest

CVE-2026-70341, published 2026-09-11. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
CVE-2026-70331, published 2026-08-28. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-66310, published 2026-08-04. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
CVE-2026-62828, published 2026-07-28. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a network.
CVE-2026-35429, published 2026-05-12. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-33119, published 2026-04-10. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-26133, published 2026-03-16. High severity, CVSS 7.1. EPSS: 0.6% chance of exploitation in the next 30 days. AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2025-62224, published 2026-01-07. Low severity, CVSS 3.5. EPSS: 0.3% chance of exploitation in the next 30 days. User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an authorized attacker to perform spoofing over a network.
CVE-2025-47967, published 2025-09-16. Medium severity, CVSS 4.7. EPSS: 0.4% chance of exploitation in the next 30 days. Insufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-49755, published 2025-08-12. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.