Edge
by Microsoft
Source repositories
CVEs (950)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-66321 | Hig | 0.48 | 7.4 | 0.01 | Aug 4, 2026 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | ||
| CVE-2026-41107 | Hig | 0.48 | 7.4 | 0.01 | May 12, 2026 | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. | ||
| CVE-2025-21399 | Hig | 0.48 | 7.4 | 0.01 | Jan 17, 2025 | Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability | ||
| CVE-2023-36014 | Hig | 0.48 | 7.3 | 0.01 | Nov 10, 2023 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | ||
| CVE-2023-36034 | Hig | 0.48 | 7.3 | 0.03 | Nov 3, 2023 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | ||
| CVE-2016-3386 | Hig | 0.48 | 7.5 | 0.41 | Oct 14, 2016 | The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3389,… | ||
| CVE-2016-0161 | Med | 0.48 | 6.5 | 0.69 | Apr 12, 2016 | Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0158. | ||
| CVE-2017-8652 | Med | 0.47 | 6.5 | 0.23 | Aug 8, 2017 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to the way that Microsoft Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from… | ||
| CVE-2016-3319 | Hig | 0.47 | 7.0 | 0.19 | Aug 9, 2016 | The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allows remote attackers to execute arbitrary code via a crafted PDF file, aka "Microsoft PDF Remote Code Execution Vulnerability." | ||
| CVE-2026-66322 | Hig | 0.46 | 7.1 | 0.00 | Aug 4, 2026 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | ||
| CVE-2026-26133 | Hig | 0.46 | 7.1 | 0.00 | Mar 16, 2026 | AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. | ||
| CVE-2026-21223 | Hig | 0.46 | 7.1 | 0.00 | Jan 16, 2026 | Improper privilege management in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally. | ||
| CVE-2024-30056 | Hig | 0.46 | 7.1 | 0.02 | May 25, 2024 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability | ||
| CVE-2023-36027 | Hig | 0.46 | 7.1 | 0.01 | Nov 10, 2023 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | ||
| CVE-2023-36024 | Hig | 0.46 | 7.1 | 0.01 | Nov 10, 2023 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | ||
| CVE-2023-36562 | Hig | 0.46 | 7.1 | 0.01 | Sep 15, 2023 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | ||
| CVE-2020-0878 | Med | 0.46 | 4.2 | 0.03 | KEV | Sep 11, 2020 | A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully… | |
| CVE-2020-1073 | Hig | 0.46 | 8.1 | 0.09 | Jun 9, 2020 | A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. | ||
| CVE-2019-0649 | Hig | 0.46 | 8.1 | 0.04 | Mar 5, 2019 | A vulnerability exists in Microsoft Chakra JIT server, aka 'Scripting Engine Elevation of Privileged Vulnerability'. | ||
| CVE-2024-21388 | Med | 0.45 | 6.5 | 0.32 | Jan 30, 2024 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
- risk 0.48cvss 7.4epss 0.01
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- risk 0.48cvss 7.4epss 0.01
External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
- risk 0.48cvss 7.4epss 0.01
Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability
- risk 0.48cvss 7.3epss 0.01
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- risk 0.48cvss 7.3epss 0.03
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- risk 0.48cvss 7.5epss 0.41
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3389,…
- risk 0.48cvss 6.5epss 0.69
Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0158.
- risk 0.47cvss 6.5epss 0.23
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to the way that Microsoft Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from…
- risk 0.47cvss 7.0epss 0.19
The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allows remote attackers to execute arbitrary code via a crafted PDF file, aka "Microsoft PDF Remote Code Execution Vulnerability."
- risk 0.46cvss 7.1epss 0.00
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- risk 0.46cvss 7.1epss 0.00
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
- risk 0.46cvss 7.1epss 0.00
Improper privilege management in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally.
- risk 0.46cvss 7.1epss 0.02
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- risk 0.46cvss 7.1epss 0.01
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- risk 0.46cvss 7.1epss 0.01
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- risk 0.46cvss 7.1epss 0.01
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- risk 0.46cvss 4.2epss 0.03
A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully…
- risk 0.46cvss 8.1epss 0.09
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'.
- risk 0.46cvss 8.1epss 0.04
A vulnerability exists in Microsoft Chakra JIT server, aka 'Scripting Engine Elevation of Privileged Vulnerability'.
- risk 0.45cvss 6.5epss 0.32
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Page 23 of 48