Loading story…
Microsoft has published a series of Security Update Guide entries for Microsoft Edge and related components addressing multiple spoofing vulnerabilities, alongside one tampering issue and one security feature bypass flaw. The affected products span Edge (Chromium-based), Edge for iOS, and Edge WebView2, with CVEs including CVE-2022-29147, CVE-2022-23264, CVE-2022-44688, CVE-2023-29334, CVE-2023-36026, CVE-2023-36029, CVE-2024-29049, CVE-2024-30055, CVE-2024-38093, CVE-2024-38221, CVE-2025-21262, and CVE-2026-33118. Microsoft also listed Edge for iOS spoofing bugs CVE-2023-36883 and CVE-2024-30057, indicating the issue class extends beyond the desktop browser.
Additional advisories show Microsoft addressing related but distinct Edge weaknesses, including the tampering vulnerability CVE-2022-23261 and the security feature bypass vulnerability CVE-2025-53791. While the advisories provided no public synopsis, the volume and recurrence of spoofing-class fixes across several release cycles indicate an ongoing need for organizations to keep Edge, iOS mobile deployments, and embedded WebView2 runtimes fully patched to reduce exposure to deceptive content, identity misrepresentation, and browser trust-boundary abuse.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
28 events from the most recent confirmed update back to the earliest known activity.
Microsoft released a Security Update Guide entry for CVE-2026-13942 affecting Microsoft Edge. The reference indicates a new vulnerability disclosure event distinct from the CVEs already captured in the timeline.
A new CVE record for CVE-2026-58283 disclosed a high-severity Microsoft Edge (Chromium-based) spoofing vulnerability. The reference lists Microsoft as the source, gives a CVSS 3.1 score of 8.1, and shows the CVE as published on July 3, 2026.
A new CVE record for CVE-2026-58282 disclosed a high-severity Microsoft Edge (Chromium-based) spoofing vulnerability. The reference lists Microsoft as the source, gives a CVSS 3.1 score of 8.1, and shows the CVE as published on July 3, 2026.
A new CVE record for CVE-2026-58286 disclosed a high-severity Microsoft Edge (Chromium-based) spoofing vulnerability. The reference lists Microsoft as the source, gives a CVSS 3.1 score of 8.1, and shows the CVE as published on July 3, 2026.
Microsoft released a Security Update Guide entry for CVE-2026-33118, a Microsoft Edge (Chromium-based) spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2025-65046, a low-severity Microsoft Edge (Chromium-based) spoofing vulnerability involving extension popups overlaying permission or screen-share prompts. Microsoft said the flaw was not publicly disclosed or exploited in the wild and that a fix was available in Edge version 143.0.3650.88.
Microsoft released a Security Update Guide entry for CVE-2025-47964, a Microsoft Edge (Chromium-based) spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2025-47963, a Microsoft Edge (Chromium-based) spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2025-21404, a Microsoft Edge (Chromium-based) spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2025-53791, a Microsoft Edge (Chromium-based) security feature bypass vulnerability.
Microsoft released a Security Update Guide entry for CVE-2025-21262, a Microsoft Edge (Chromium-based) spoofing vulnerability. Duplicate references point to the same disclosure event.
Microsoft released a Security Update Guide entry for CVE-2024-49054, a Microsoft Edge (Chromium-based) spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2024-30055, a Microsoft Edge (Chromium-based) spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2024-38221, a Microsoft Edge (Chromium-based) spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2024-38093, a Microsoft Edge (Chromium-based) spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2024-30057, a Microsoft Edge for iOS spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2024-29049, a Microsoft Edge (Chromium-based) WebView2 spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2024-21336, a Microsoft Edge (Chromium-based) spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2023-36026, a Microsoft Edge (Chromium-based) spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2023-21794, a Microsoft Edge (Chromium-based) spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2023-36883, a Microsoft Edge for iOS spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2023-29334, a Microsoft Edge (Chromium-based) spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2023-36029, a Microsoft Edge (Chromium-based) spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2022-23264, a Microsoft Edge (Chromium-based) spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2022-26905, a Microsoft Edge (Chromium-based) spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2022-44688, a Microsoft Edge (Chromium-based) spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2022-29147, a Microsoft Edge (Chromium-based) spoofing vulnerability.
Microsoft released a Security Update Guide entry for CVE-2022-23261, a Microsoft Edge (Chromium-based) tampering vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
29 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has disclosed and patched multiple **spoofing vulnerabilities** affecting **Microsoft Edge for Android**, including `CVE-2026-35429`, `CVE-2026-42891`, `CVE-2026-0391`, `CVE-2025-47967`, and the earlier `CVE-2024-21387`. The issues are described as **user interface misrepresentation** flaws that could let an unauthenticated attacker present misleading content over a network, potentially tricking users who visit attacker-controlled pages. The repeated classification points to browser UI spoofing risks in the Android version of Edge rather than code execution or privilege escalation. For `CVE-2026-35429`, Microsoft said the flaw was rated **Moderate** with a **CVSS v3.1 score of 4.3**, required **user interaction**, and had **low attack complexity** with **no privileges required**. Microsoft also stated the vulnerability was **not publicly disclosed** and **not exploited** at the time of publication, and released a fix in **Microsoft Edge for Android version `148.0.3967.55`**. The additional CVE entries indicate a broader pattern of Edge for Android spoofing issues being tracked and remediated through Microsoft’s Security Update Guide.
Jun 29, 2026
Microsoft has issued security advisories for a series of **Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability** flaws affecting the browser across multiple release cycles. The referenced issues include `CVE-2021-31982`, `CVE-2021-34506`, `CVE-2023-21719`, `CVE-2023-29345`, `CVE-2023-29354`, `CVE-2023-36878`, `CVE-2024-26163`, `CVE-2024-26247`, `CVE-2024-29991`, and `CVE-2025-53791`, all published through Microsoft's Security Update Guide and MSRC portal. The advisories identify a recurring class of weakness in Edge in which built-in browser protections can be bypassed, potentially reducing the effectiveness of security boundaries and defensive controls. While the provided notices do not include technical synopses, the volume and continuity of CVEs show Microsoft repeatedly addressing security-feature-bypass conditions in Edge, underscoring the need for organizations to keep the Chromium-based browser fully updated and to track MSRC guidance for remediation.
Jul 8, 2026
Microsoft has published security advisories for a series of **Microsoft Edge (Chromium-based) information disclosure vulnerabilities** affecting the browser across multiple release cycles. The referenced issues include `CVE-2021-36929`, `CVE-2023-33145`, `CVE-2023-36880`, `CVE-2023-38158`, `CVE-2024-21423`, `CVE-2024-29987`, `CVE-2024-30056`, `CVE-2024-38103`, `CVE-2024-38222`, `CVE-2024-49025`, and `CVE-2025-49741`, all listed by Microsoft as information disclosure vulnerabilities in the Chromium-based Edge browser. The advisories provide limited public detail, but the volume and recurrence of these CVEs show an ongoing stream of browser security fixes tied to unintended exposure of sensitive information. For defenders, the immediate takeaway is to ensure **Microsoft Edge is kept fully updated** and to track MSRC guidance for affected versions, as browser-based information disclosure bugs can aid reconnaissance, weaken privacy protections, or support follow-on exploitation when chained with other vulnerabilities.
Jul 8, 2026