Loading story…
Microsoft disclosed CVE-2026-42838, an elevation of privilege flaw in Chromium-based Microsoft Edge caused by improper neutralization of special elements in output used by a downstream component (CWE-74). The company rated the issue Moderate with a CVSS 3.1 score of 5.4, stating that exploitation requires user interaction, can be launched over the network with low attack complexity, and would give an attacker the same rights as the user running the browser. Microsoft said the vulnerability was not publicly disclosed, not exploited in the wild, and less likely to be exploited at the time of publication.
A fix was released in Microsoft Edge version 148.0.3967.55, based on Chromium 148.0.7778.97. The disclosure follows a long pattern of Microsoft Edge privilege-escalation advisories, including earlier CVEs such as CVE-2022-26895, CVE-2022-23262, CVE-2022-26908, CVE-2022-26894, CVE-2022-26900, CVE-2022-44708, CVE-2022-21954, CVE-2022-21970, CVE-2021-34475, CVE-2022-33680, and CVE-2022-26909, underscoring the recurring need to keep Edge updated to the latest security release.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Microsoft disclosed CVE-2026-42838, a moderate-severity Chromium-based Edge elevation of privilege flaw caused by improper neutralization of special elements in output used by a downstream component. Microsoft said the issue was neither publicly disclosed nor exploited in the wild at publication and released a fix in Edge version 148.0.3967.55 based on Chromium 148.0.7778.97.
Microsoft published a Security Update Guide entry for CVE-2022-33680, an elevation of privilege vulnerability in Chromium-based Microsoft Edge.
Microsoft published a Security Update Guide entry for CVE-2022-44708, identifying an elevation of privilege vulnerability in Chromium-based Microsoft Edge.
Microsoft published a Security Update Guide entry for CVE-2022-23262, another elevation of privilege vulnerability in Chromium-based Microsoft Edge.
Microsoft published Security Update Guide entries for CVE-2022-21954 and CVE-2022-21970 affecting Chromium-based Microsoft Edge. The CVE-2022-21954 entry appears in both the MSRC portal and product advisories and is treated as a single disclosure event.
Microsoft published Security Update Guide entries for several Chromium-based Microsoft Edge elevation of privilege flaws: CVE-2022-26894, CVE-2022-26895, CVE-2022-26900, CVE-2022-26908, and CVE-2022-26909.
Microsoft published a Security Update Guide entry for CVE-2021-34475, an elevation of privilege vulnerability affecting Chromium-based Microsoft Edge.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceportal.msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has published Security Update Guide entries for multiple **Microsoft Edge (Chromium-based)** elevation of privilege vulnerabilities, including `CVE-2022-30127`, `CVE-2023-36027`, and `CVE-2024-21388`. The advisories indicate that separate privilege-escalation issues have been identified in the browser across multiple release cycles, reinforcing Edge as a recurring target for flaws that could allow an attacker to gain higher privileges on an affected system. While the referenced advisories provide limited public technical detail, the affected product and vulnerability class are consistent across all entries: **Elevation of Privilege** in Chromium-based Edge. Organizations using Microsoft Edge should review the corresponding Security Update Guide records, verify that browser updates have been applied across endpoints, and prioritize remediation because privilege-escalation bugs can increase the impact of other compromises by helping attackers move from initial code execution or user-level access to more powerful system permissions.
Jul 9, 2026
Microsoft has published security advisories for a series of **Microsoft Edge (Chromium-based) information disclosure vulnerabilities** affecting the browser across multiple release cycles. The referenced issues include `CVE-2021-36929`, `CVE-2023-33145`, `CVE-2023-36880`, `CVE-2023-38158`, `CVE-2024-21423`, `CVE-2024-29987`, `CVE-2024-30056`, `CVE-2024-38103`, `CVE-2024-38222`, `CVE-2024-49025`, and `CVE-2025-49741`, all listed by Microsoft as information disclosure vulnerabilities in the Chromium-based Edge browser. The advisories provide limited public detail, but the volume and recurrence of these CVEs show an ongoing stream of browser security fixes tied to unintended exposure of sensitive information. For defenders, the immediate takeaway is to ensure **Microsoft Edge is kept fully updated** and to track MSRC guidance for affected versions, as browser-based information disclosure bugs can aid reconnaissance, weaken privacy protections, or support follow-on exploitation when chained with other vulnerabilities.
Jul 9, 2026
Microsoft Edge (Chromium-based) has received fixes for multiple high-severity vulnerabilities, including remote code execution flaws `CVE-2026-58289`, `CVE-2026-58293`, `CVE-2026-58285`, `CVE-2026-58288`, `CVE-2026-57974`, `CVE-2026-58284`, `CVE-2026-58287`, `CVE-2026-57981`, and `CVE-2026-56645`, as well as the security feature bypass issue `CVE-2026-57983`. Public records attribute the issues to Microsoft and rate them from high to critical severity, with CVSS scores reaching **9.0** for `CVE-2026-58289` and several others scoring in the **8.1-8.8** range. Advisories from Microsoft and HKCERT indicate the flaws affect Microsoft Edge and require prompt patching through the browser's latest security updates. While some metadata inconsistently marks the bugs as not remotely exploitable, the listed attack characteristics for several entries include low attack complexity, no privileges required, and in many cases user interaction, making browser update compliance and rapid deployment a priority for enterprise defenders.
Jul 7, 2026