Edgechromium
by Microsoft
CVEs (340)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-66313 | Med | 0.44 | 6.8 | 0.00 | Aug 4, 2026 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally. | ||
| CVE-2021-21135 | Med | 0.44 | 6.5 | 0.19 | Feb 9, 2021 | Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | ||
| CVE-2023-36008 | Med | 0.43 | 6.6 | 0.01 | Nov 16, 2023 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | ||
| CVE-2023-36022 | Med | 0.43 | 6.6 | 0.01 | Nov 3, 2023 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | ||
| CVE-2022-41115 | Med | 0.43 | 6.6 | 0.02 | Dec 13, 2022 | Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability | ||
| CVE-2021-30621 | Med | 0.43 | 6.5 | 0.03 | Sep 3, 2021 | Chromium: CVE-2021-30621 UI Spoofing in Autofill | ||
| CVE-2021-30619 | Med | 0.43 | 6.5 | 0.03 | Sep 3, 2021 | Chromium: CVE-2021-30619 UI Spoofing in Autofill | ||
| CVE-2021-30617 | Med | 0.43 | 6.5 | 0.04 | Sep 3, 2021 | Chromium: CVE-2021-30617 Policy bypass in Blink | ||
| CVE-2021-30615 | Med | 0.43 | 6.5 | 0.06 | Sep 3, 2021 | Chromium: CVE-2021-30615 Cross-origin data leak in Navigation | ||
| CVE-2021-21139 | Med | 0.43 | 6.5 | 0.05 | Feb 9, 2021 | Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. | ||
| CVE-2021-21137 | Med | 0.43 | 6.5 | 0.06 | Feb 9, 2021 | Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page. | ||
| CVE-2021-21136 | Med | 0.43 | 6.5 | 0.04 | Feb 9, 2021 | Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | ||
| CVE-2021-21134 | Med | 0.43 | 6.5 | 0.05 | Feb 9, 2021 | Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker to spoof security UI via a crafted HTML page. | ||
| CVE-2021-21131 | Med | 0.43 | 6.5 | 0.08 | Feb 9, 2021 | Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. | ||
| CVE-2021-21130 | Med | 0.43 | 6.5 | 0.05 | Feb 9, 2021 | Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. | ||
| CVE-2021-21129 | Med | 0.43 | 6.5 | 0.05 | Feb 9, 2021 | Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. | ||
| CVE-2021-21126 | Med | 0.43 | 6.5 | 0.09 | Feb 9, 2021 | Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass site isolation via a crafted Chrome Extension. | ||
| CVE-2021-21123 | Med | 0.43 | 6.5 | 0.11 | Feb 9, 2021 | Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. | ||
| CVE-2019-1023 | Med | 0.43 | 6.5 | 0.05 | Jun 12, 2019 | An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. In a web-based… | ||
| CVE-2019-0990 | Med | 0.43 | 6.5 | 0.05 | Jun 12, 2019 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current… |
- risk 0.44cvss 6.8epss 0.00
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.
- risk 0.44cvss 6.5epss 0.19
Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- risk 0.43cvss 6.6epss 0.01
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- risk 0.43cvss 6.6epss 0.01
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- risk 0.43cvss 6.6epss 0.02
Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability
- risk 0.43cvss 6.5epss 0.03
Chromium: CVE-2021-30621 UI Spoofing in Autofill
- risk 0.43cvss 6.5epss 0.03
Chromium: CVE-2021-30619 UI Spoofing in Autofill
- risk 0.43cvss 6.5epss 0.04
Chromium: CVE-2021-30617 Policy bypass in Blink
- risk 0.43cvss 6.5epss 0.06
Chromium: CVE-2021-30615 Cross-origin data leak in Navigation
- risk 0.43cvss 6.5epss 0.05
Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
- risk 0.43cvss 6.5epss 0.06
Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page.
- risk 0.43cvss 6.5epss 0.04
Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- risk 0.43cvss 6.5epss 0.05
Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker to spoof security UI via a crafted HTML page.
- risk 0.43cvss 6.5epss 0.08
Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.
- risk 0.43cvss 6.5epss 0.05
Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.
- risk 0.43cvss 6.5epss 0.05
Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.
- risk 0.43cvss 6.5epss 0.09
Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass site isolation via a crafted Chrome Extension.
- risk 0.43cvss 6.5epss 0.11
Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.
- risk 0.43cvss 6.5epss 0.05
An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. In a web-based…
- risk 0.43cvss 6.5epss 0.05
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current…
Page 7 of 17