Loading story…
Microsoft has issued security advisories for a series of Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability flaws affecting the browser across multiple release cycles. The referenced issues include CVE-2021-31982, CVE-2021-34506, CVE-2023-21719, CVE-2023-29345, CVE-2023-29354, CVE-2023-36878, CVE-2024-26163, CVE-2024-26247, CVE-2024-29991, and CVE-2025-53791, all published through Microsoft's Security Update Guide and MSRC portal.
The advisories identify a recurring class of weakness in Edge in which built-in browser protections can be bypassed, potentially reducing the effectiveness of security boundaries and defensive controls. While the provided notices do not include technical synopses, the volume and continuity of CVEs show Microsoft repeatedly addressing security-feature-bypass conditions in Edge, underscoring the need for organizations to keep the Chromium-based browser fully updated and to track MSRC guidance for remediation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
14 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a Security Update Guide entry for CVE-2025-53791, identified as a Microsoft Edge (Chromium-based) security feature bypass vulnerability.
Microsoft published a Security Update Guide entry for CVE-2024-29991 affecting Microsoft Edge (Chromium-based) as a security feature bypass vulnerability.
Microsoft published a Security Update Guide entry for CVE-2024-26247, a security feature bypass vulnerability in Microsoft Edge (Chromium-based).
Microsoft published a Security Update Guide entry for CVE-2024-26246, identified as a Microsoft Edge (Chromium-based) security feature bypass vulnerability.
Microsoft published a Security Update Guide entry for CVE-2024-26163 affecting Microsoft Edge (Chromium-based) as a security feature bypass vulnerability.
Microsoft published a Security Update Guide entry for CVE-2023-36878, described as a Microsoft Edge (Chromium-based) security feature bypass vulnerability.
Microsoft published a Security Update Guide entry for CVE-2023-38157, identified as a Microsoft Edge (Chromium-based) security feature bypass vulnerability.
Microsoft published a Security Update Guide entry for CVE-2023-29345 affecting Microsoft Edge (Chromium-based) as a security feature bypass vulnerability.
Microsoft published a Security Update Guide entry for CVE-2023-29354, a security feature bypass vulnerability in Microsoft Edge (Chromium-based).
Microsoft published a Security Update Guide entry for CVE-2023-21719 affecting Microsoft Edge (Chromium-based) as a security feature bypass vulnerability.
Microsoft published a Security Update Guide entry for CVE-2022-33649, identified as a Microsoft Edge (Chromium-based) security feature bypass vulnerability.
Microsoft published a Security Update Guide entry for CVE-2021-34506, identified as a Microsoft Edge (Chromium-based) security feature bypass vulnerability.
Microsoft published a Security Update Guide entry for CVE-2021-31982, a Microsoft Edge (Chromium-based) security feature bypass vulnerability.
Microsoft published a Security Update Guide entry for CVE-2021-24113, identified as a Microsoft Edge (Chromium-based) security feature bypass vulnerability.
14 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceportal.msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft Edge (Chromium-based) has received fixes for multiple high-severity vulnerabilities, including remote code execution flaws `CVE-2026-58289`, `CVE-2026-58293`, `CVE-2026-58285`, `CVE-2026-58288`, `CVE-2026-57974`, `CVE-2026-58284`, `CVE-2026-58287`, `CVE-2026-57981`, and `CVE-2026-56645`, as well as the security feature bypass issue `CVE-2026-57983`. Public records attribute the issues to Microsoft and rate them from high to critical severity, with CVSS scores reaching **9.0** for `CVE-2026-58289` and several others scoring in the **8.1-8.8** range. Advisories from Microsoft and HKCERT indicate the flaws affect Microsoft Edge and require prompt patching through the browser's latest security updates. While some metadata inconsistently marks the bugs as not remotely exploitable, the listed attack characteristics for several entries include low attack complexity, no privileges required, and in many cases user interaction, making browser update compliance and rapid deployment a priority for enterprise defenders.
Jul 7, 2026
Microsoft has issued security advisories for a long-running series of **remote code execution** vulnerabilities affecting **Microsoft Edge (Chromium-based)**, with disclosures spanning multiple product update cycles. The referenced flaws include `CVE-2021-43221`, `CVE-2022-21929`, `CVE-2022-33636`, `CVE-2022-38012`, `CVE-2023-21775`, `CVE-2023-36008`, `CVE-2023-36022`, `CVE-2023-36034`, `CVE-2024-38210`, `CVE-2024-38219`, `CVE-2024-43496`, `CVE-2024-43578`, `CVE-2024-43596`, `CVE-2024-49023`, `CVE-2025-21408`, `CVE-2025-25000`, `CVE-2025-29834`, and `CVE-2025-60711`, all tracked by Microsoft as Edge RCE issues. The advisories indicate continued patching of browser-exposed attack surface in Edge, including several clusters of RCE fixes released on the same day, suggesting bundled security updates across versions. While the entries provided do not include technical synopses or exploitation details, the repeated publication of Edge RCE bulletins through Microsoft Update Guide and MSRC portal pages shows sustained remediation activity for code-execution bugs that could be triggered through malicious web content or browser processing components, reinforcing the need for rapid browser update deployment across enterprise fleets.
Jul 8, 2026
Microsoft has published security advisories for a series of **Microsoft Edge (Chromium-based) information disclosure vulnerabilities** affecting the browser across multiple release cycles. The referenced issues include `CVE-2021-36929`, `CVE-2023-33145`, `CVE-2023-36880`, `CVE-2023-38158`, `CVE-2024-21423`, `CVE-2024-29987`, `CVE-2024-30056`, `CVE-2024-38103`, `CVE-2024-38222`, `CVE-2024-49025`, and `CVE-2025-49741`, all listed by Microsoft as information disclosure vulnerabilities in the Chromium-based Edge browser. The advisories provide limited public detail, but the volume and recurrence of these CVEs show an ongoing stream of browser security fixes tied to unintended exposure of sensitive information. For defenders, the immediate takeaway is to ensure **Microsoft Edge is kept fully updated** and to track MSRC guidance for affected versions, as browser-based information disclosure bugs can aid reconnaissance, weaken privacy protections, or support follow-on exploitation when chained with other vulnerabilities.
Jul 8, 2026