Loading story…
Microsoft has issued security advisories for a long-running series of remote code execution vulnerabilities affecting Microsoft Edge (Chromium-based), with disclosures spanning multiple product update cycles. The referenced flaws include CVE-2021-43221, CVE-2022-21929, CVE-2022-33636, CVE-2022-38012, CVE-2023-21775, CVE-2023-36008, CVE-2023-36022, CVE-2023-36034, CVE-2024-38210, CVE-2024-38219, CVE-2024-43496, CVE-2024-43578, CVE-2024-43596, CVE-2024-49023, CVE-2025-21408, CVE-2025-25000, CVE-2025-29834, and CVE-2025-60711, all tracked by Microsoft as Edge RCE issues.
The advisories indicate continued patching of browser-exposed attack surface in Edge, including several clusters of RCE fixes released on the same day, suggesting bundled security updates across versions. While the entries provided do not include technical synopses or exploitation details, the repeated publication of Edge RCE bulletins through Microsoft Update Guide and MSRC portal pages shows sustained remediation activity for code-execution bugs that could be triggered through malicious web content or browser processing components, reinforcing the need for rapid browser update deployment across enterprise fleets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
18 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a Security Update Guide entry for CVE-2025-29834, identifying a remote code execution vulnerability in Microsoft Edge (Chromium-based).
Microsoft released Security Update Guide entries for CVE-2025-60711, a remote code execution vulnerability affecting Microsoft Edge (Chromium-based). Multiple references correspond to the same disclosure event.
Microsoft disclosed CVE-2025-21408 as a remote code execution vulnerability in Microsoft Edge (Chromium-based) through its Security Update Guide.
Microsoft published a Security Update Guide entry for CVE-2025-25000, a remote code execution vulnerability affecting Microsoft Edge (Chromium-based).
Microsoft released Security Update Guide entries for CVE-2024-43578, CVE-2024-43596, and CVE-2024-49023, all remote code execution vulnerabilities in Microsoft Edge (Chromium-based).
Microsoft disclosed CVE-2024-43496 as a remote code execution vulnerability affecting Microsoft Edge (Chromium-based).
Microsoft released a Security Update Guide entry for CVE-2024-38210, identifying a remote code execution vulnerability in Microsoft Edge (Chromium-based).
Microsoft disclosed CVE-2024-38219 as a remote code execution vulnerability in Microsoft Edge (Chromium-based) through its Security Update Guide.
Microsoft published a Security Update Guide entry for CVE-2023-36008, a remote code execution vulnerability affecting Microsoft Edge (Chromium-based).
Microsoft published a Security Update Guide entry for CVE-2023-36014, identifying a remote code execution vulnerability in Microsoft Edge (Chromium-based). This represents a separate vulnerability disclosure from other Edge advisories already in the timeline.
Microsoft published a Security Update Guide entry for CVE-2023-36887, identifying a remote code execution vulnerability in Microsoft Edge (Chromium-based). This is a separate Edge vulnerability disclosure from other 2023 advisories already in the timeline.
Microsoft released Security Update Guide entries for CVE-2023-36022 and CVE-2023-36034, both remote code execution vulnerabilities in Microsoft Edge (Chromium-based). Duplicate portal and advisory references indicate the same disclosure event.
Microsoft disclosed CVE-2023-21775 as a remote code execution vulnerability in Microsoft Edge (Chromium-based) via its Security Update Guide.
Microsoft published a Security Update Guide entry for CVE-2022-21931, identifying a remote code execution vulnerability in Microsoft Edge (Chromium-based). This represents a separate vulnerability disclosure from the other Edge advisories released the same day.
Microsoft disclosed CVE-2022-33636 as a remote code execution vulnerability in Microsoft Edge (Chromium-based) through its Security Update Guide.
Microsoft published a Security Update Guide entry for CVE-2022-38012, identifying a remote code execution vulnerability in Microsoft Edge (Chromium-based).
Microsoft released Security Update Guide advisories for CVE-2022-21929 and CVE-2022-21930, both remote code execution vulnerabilities affecting Microsoft Edge (Chromium-based). Portal and product advisory listings refer to the same disclosure date.
Microsoft released a Security Update Guide entry for CVE-2021-43221, a remote code execution vulnerability affecting Microsoft Edge (Chromium-based). This marks public disclosure of the vulnerability in Microsoft's advisory portal.
26 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceportal.msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft Edge (Chromium-based) has received fixes for multiple high-severity vulnerabilities, including remote code execution flaws `CVE-2026-58289`, `CVE-2026-58293`, `CVE-2026-58285`, `CVE-2026-58288`, `CVE-2026-57974`, `CVE-2026-58284`, `CVE-2026-58287`, `CVE-2026-57981`, and `CVE-2026-56645`, as well as the security feature bypass issue `CVE-2026-57983`. Public records attribute the issues to Microsoft and rate them from high to critical severity, with CVSS scores reaching **9.0** for `CVE-2026-58289` and several others scoring in the **8.1-8.8** range. Advisories from Microsoft and HKCERT indicate the flaws affect Microsoft Edge and require prompt patching through the browser's latest security updates. While some metadata inconsistently marks the bugs as not remotely exploitable, the listed attack characteristics for several entries include low attack complexity, no privileges required, and in many cases user interaction, making browser update compliance and rapid deployment a priority for enterprise defenders.
Jul 7, 2026
Microsoft has published Security Update Guide entries for two **Microsoft Edge (Chromium-based)** remote code execution flaws, **`CVE-2025-21342`** and **`CVE-2022-21931`**. Both advisories identify the same impact category—remote code execution in the browser—indicating that successful exploitation could allow malicious code to run in the context of the targeted Edge process. The disclosures show Microsoft continuing to track and remediate serious browser security issues affecting its Chromium-based Edge platform through formal update guidance. Organizations using Microsoft Edge should review the relevant Security Update Guide entries for affected versions and apply available browser updates promptly, as RCE flaws in web browsers can be triggered through malicious web content and pose a direct risk to enterprise endpoints.
Jul 7, 2026
Microsoft Edge users faced a series of serious vulnerabilities spanning remote code execution, information disclosure, and legacy browser compatibility risks. Reported issues included `CVE-2025-59251`, an Edge remote code execution flaw with limited public technical detail; `CVE-2025-29834`, an out-of-bounds read in the V8 JavaScript engine affecting versions before `135.0.2789.91`; and `CVE-2025-49713`, a type confusion bug in V8 that reportedly enabled in-the-wild exploitation against Edge versions before `138.0.3351.65`. Separately, `CVE-2025-49741` was described as an information disclosure issue tied to improper validation of the `x-middleware-subrequest` HTTP header, potentially exposing cached data and session tokens in versions before `137.0.3296.62`. The disclosures also highlighted risk beyond standard browsing sessions. `CVE-2025-30397` affected Microsoft’s Scripting Engine when Edge was used in Internet Explorer Mode, creating an actively exploited path to remote code execution on Windows 10 and Windows 11 systems that still depend on legacy web applications. Microsoft issued updates across the affected products, while defenders were urged to prioritize browser patching, review exposure in Chromium-based deployments, harden JavaScript and web-content controls, and reduce or disable IE Mode where operationally possible. A new advisory from HKCERT on multiple Microsoft Edge vulnerabilities underscores the continuing volume of security issues affecting the browser.
Jun 29, 2026