Microsoft Edge Chromium vulnerabilities

309 CVEs affecting Microsoft Edge Chromium, 9 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-88097, published 2026-09-18.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-4863: Google Chromium WebP Heap-Based Buffer Overflow Vulnerability, published 2023-09-12. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2023-09-13. EPSS: 100% chance of exploitation in the next 30 days. Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium…
• CVE-2023-5217: Google Chromium libvpx Heap Buffer Overflow Vulnerability, published 2023-09-28. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2023-10-02. EPSS: 49% chance of exploitation in the next 30 days. Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
• CVE-2020-16009: Google Chromium V8 Type Confusion Vulnerability, published 2020-11-03. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 48.3% chance of exploitation in the next 30 days. Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2023-4762: Google Chromium V8 Type Confusion Vulnerability, published 2023-09-05. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2024-02-06. EPSS: 41.4% chance of exploitation in the next 30 days. Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
• CVE-2022-4135: Google Chromium GPU Heap Buffer Overflow Vulnerability, published 2022-11-25. Critical severity, CVSS 9.6. Actively exploited: in CISA KEV since 2022-11-28. EPSS: 31.9% chance of exploitation in the next 30 days. Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML…
• CVE-2025-14174: Google Chromium Out of Bounds Memory Access Vulnerability, published 2025-12-12. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-12-12. EPSS: 22.3% chance of exploitation in the next 30 days. Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security…
• CVE-2024-7965: Google Chromium V8 Inappropriate Implementation Vulnerability, published 2024-08-21. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2024-08-28. EPSS: 18.5% chance of exploitation in the next 30 days. Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
• CVE-2023-6345: Google Skia Integer Overflow Vulnerability, published 2023-11-29. Critical severity, CVSS 9.6. Actively exploited: in CISA KEV since 2023-11-30. EPSS: 16.5% chance of exploitation in the next 30 days. Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file.…
• CVE-2025-5419: Google Chromium V8 Out-of-Bounds Read and Write Vulnerability, published 2025-06-03. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-06-05. EPSS: 7.8% chance of exploitation in the next 30 days. Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
• CVE-2023-6702, published 2023-12-14. High severity, CVSS 8.8. EPSS: 44.3% chance of exploitation in the next 30 days. Type confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Latest

• CVE-2026-88097, published 2026-09-18. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.
• CVE-2026-85893, published 2026-09-15. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-69486, published 2026-09-15. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
• CVE-2026-85892, published 2026-09-14. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
• CVE-2026-77490, published 2026-09-11. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
• CVE-2026-70341, published 2026-09-11. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
• CVE-2026-72984, published 2026-08-28. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
• CVE-2026-70331, published 2026-08-28. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
• CVE-2026-70309, published 2026-08-28. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
• CVE-2026-66798, published 2026-08-28. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.