Loading story…
Microsoft has published security advisories for a series of Microsoft Edge (Chromium-based) information disclosure vulnerabilities affecting the browser across multiple release cycles. The referenced issues include CVE-2021-36929, CVE-2023-33145, CVE-2023-36880, CVE-2023-38158, CVE-2024-21423, CVE-2024-29987, CVE-2024-30056, CVE-2024-38103, CVE-2024-38222, CVE-2024-49025, and CVE-2025-49741, all listed by Microsoft as information disclosure vulnerabilities in the Chromium-based Edge browser.
The advisories provide limited public detail, but the volume and recurrence of these CVEs show an ongoing stream of browser security fixes tied to unintended exposure of sensitive information. For defenders, the immediate takeaway is to ensure Microsoft Edge is kept fully updated and to track MSRC guidance for affected versions, as browser-based information disclosure bugs can aid reconnaissance, weaken privacy protections, or support follow-on exploitation when chained with other vulnerabilities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
Microsoft released a Security Update Guide entry for CVE-2025-49741, an information disclosure vulnerability affecting Microsoft Edge (Chromium-based).
Microsoft released a Security Update Guide entry for CVE-2024-49025, an information disclosure vulnerability affecting Microsoft Edge (Chromium-based).
Microsoft released a Security Update Guide entry for CVE-2024-38222, an information disclosure vulnerability affecting Microsoft Edge (Chromium-based).
Microsoft released a Security Update Guide entry for CVE-2024-38103, an information disclosure vulnerability affecting Microsoft Edge (Chromium-based).
Microsoft released a Security Update Guide entry for CVE-2024-30056, an information disclosure vulnerability affecting Microsoft Edge (Chromium-based).
Microsoft released a Security Update Guide entry for CVE-2024-29987, an information disclosure vulnerability affecting Microsoft Edge (Chromium-based).
Microsoft released a Security Update Guide entry for CVE-2024-21423, an information disclosure vulnerability affecting Microsoft Edge (Chromium-based).
Microsoft released a Security Update Guide entry for CVE-2023-38158, an information disclosure vulnerability affecting Microsoft Edge (Chromium-based).
Microsoft published security guidance for CVE-2023-36880, describing an information disclosure vulnerability in Microsoft Edge (Chromium-based).
Microsoft released a Security Update Guide entry for CVE-2023-38174, an information disclosure vulnerability affecting Microsoft Edge (Chromium-based).
Microsoft released a Security Update Guide entry for CVE-2023-33145, an information disclosure vulnerability affecting Microsoft Edge (Chromium-based).
Microsoft released a Security Update Guide entry for CVE-2021-36929, an information disclosure vulnerability affecting Microsoft Edge (Chromium-based).
12 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceportal.msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has issued security advisories for a long-running series of **remote code execution** vulnerabilities affecting **Microsoft Edge (Chromium-based)**, with disclosures spanning multiple product update cycles. The referenced flaws include `CVE-2021-43221`, `CVE-2022-21929`, `CVE-2022-33636`, `CVE-2022-38012`, `CVE-2023-21775`, `CVE-2023-36008`, `CVE-2023-36022`, `CVE-2023-36034`, `CVE-2024-38210`, `CVE-2024-38219`, `CVE-2024-43496`, `CVE-2024-43578`, `CVE-2024-43596`, `CVE-2024-49023`, `CVE-2025-21408`, `CVE-2025-25000`, `CVE-2025-29834`, and `CVE-2025-60711`, all tracked by Microsoft as Edge RCE issues. The advisories indicate continued patching of browser-exposed attack surface in Edge, including several clusters of RCE fixes released on the same day, suggesting bundled security updates across versions. While the entries provided do not include technical synopses or exploitation details, the repeated publication of Edge RCE bulletins through Microsoft Update Guide and MSRC portal pages shows sustained remediation activity for code-execution bugs that could be triggered through malicious web content or browser processing components, reinforcing the need for rapid browser update deployment across enterprise fleets.
Jul 8, 2026
Microsoft Edge users faced a series of serious vulnerabilities spanning remote code execution, information disclosure, and legacy browser compatibility risks. Reported issues included `CVE-2025-59251`, an Edge remote code execution flaw with limited public technical detail; `CVE-2025-29834`, an out-of-bounds read in the V8 JavaScript engine affecting versions before `135.0.2789.91`; and `CVE-2025-49713`, a type confusion bug in V8 that reportedly enabled in-the-wild exploitation against Edge versions before `138.0.3351.65`. Separately, `CVE-2025-49741` was described as an information disclosure issue tied to improper validation of the `x-middleware-subrequest` HTTP header, potentially exposing cached data and session tokens in versions before `137.0.3296.62`. The disclosures also highlighted risk beyond standard browsing sessions. `CVE-2025-30397` affected Microsoft’s Scripting Engine when Edge was used in Internet Explorer Mode, creating an actively exploited path to remote code execution on Windows 10 and Windows 11 systems that still depend on legacy web applications. Microsoft issued updates across the affected products, while defenders were urged to prioritize browser patching, review exposure in Chromium-based deployments, harden JavaScript and web-content controls, and reduce or disable IE Mode where operationally possible. A new advisory from HKCERT on multiple Microsoft Edge vulnerabilities underscores the continuing volume of security issues affecting the browser.
Jun 29, 2026
Microsoft has published Security Update Guide entries for multiple **Microsoft Edge (Chromium-based)** elevation of privilege vulnerabilities, including `CVE-2022-30127`, `CVE-2023-36027`, and `CVE-2024-21388`. The advisories indicate that separate privilege-escalation issues have been identified in the browser across multiple release cycles, reinforcing Edge as a recurring target for flaws that could allow an attacker to gain higher privileges on an affected system. While the referenced advisories provide limited public technical detail, the affected product and vulnerability class are consistent across all entries: **Elevation of Privilege** in Chromium-based Edge. Organizations using Microsoft Edge should review the corresponding Security Update Guide records, verify that browser updates have been applied across endpoints, and prioritize remediation because privilege-escalation bugs can increase the impact of other compromises by helping attackers move from initial code execution or user-level access to more powerful system permissions.
Jul 8, 2026