Edge vulnerabilitiesAnd the versions its exploited flaws hit.
Edge is made by Microsoft. We track 756 published vulnerabilities listed under that exact name, across 95 versions. 12 of them are on the list of flaws known to be exploited, the newest added on 26 August 2024. Microsoft lists newer releases under their own names, such as Edge Chromium, so check those pages too.
The most recent Edge flaw added to the known-exploited list is CVE-2024-7971, on 26 August 2024. We keep watching the known-exploited list.
Is Edge listed under other names? Yes.
Microsoft also lists Edge under more specific names, such as Edge Chromium and Edge Ios. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
Which versions of Edge do the exploited flaws hit?
Each exploited flaw lists the versions it affects, usually as ranges. "before 128.0.2739.42" means every version up to, but not including, 128.0.2739.42. Find your version, then patch.
- CVE-2024-7971Exploited list, 26 Aug 2024
Google Chromium V8 Type Confusion Vulnerability
before 128.0.2739.42 - CVE-2023-5217Exploited list, 2 Oct 2023
Google Chromium libvpx Heap Buffer Overflow Vulnerability
116.0.1938.98117.0.2045.47 - CVE-2022-4135Exploited list, 28 Nov 2022
Google Chromium GPU Heap Buffer Overflow Vulnerability
before 107.0.1418.62 - CVE-2017-0037Exploited list, 28 Mar 2022
Microsoft Edge and Internet Explorer Type Confusion Vulnerability
all versions - CVE-2020-16009Exploited list, 3 Nov 2021
Google Chromium V8 Type Confusion Vulnerability
before 86.0.622.63
7 more exploited flaws name Edge without a version of its own, for example as the system other affected software runs on. They are in the list below.
Which Edge vulnerabilities are being exploited?
12 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.6Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page.
- 8.8Google Chromium libvpx Heap Buffer Overflow Vulnerability
Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 9.6Google Chromium GPU Heap Buffer Overflow Vulnerability
Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.
- 6.5Microsoft Internet Explorer and Edge Information Disclosure Vulnerability
An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory.
- 9.8Adobe Flash Player Remote Code Execution Vulnerability
Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.
- 9.8Adobe Flash Player Use-After-Free Vulnerability
Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code.
- 8.1Microsoft Edge and Internet Explorer Type Confusion Vulnerability
Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.
- 8.8Microsoft Edge Memory Corruption Vulnerability
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
Which Edge flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 83%CVE-2019-0539High
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects...
- 83%
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory...
- 81%CVE-2018-0758High
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in...
- 81%
Internet Explorer Memory Corruption Vulnerability
- 80%
Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote...
- 80%CVE-2019-0567High
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects...
- 80%
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory...
- 79%CVE-2018-0769High
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in...
Running Edge? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Matched to
- Edge on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 756 published vulnerabilities listed under the name Edge, across 95 versions. The most recent Edge flaw added to the known-exploited list is CVE-2024-7971, on 26 August 2024.
12 are on the list of flaws known to be exploited. The most recently added are CVE-2024-7971, CVE-2023-5217 and CVE-2022-4135.
Microsoft also lists Edge under more specific names, such as Edge Chromium and Edge Ios. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Each flaw names its own versions, usually as ranges. The newest, CVE-2024-7971, affects before 128.0.2739.42. The versions for every exploited flaw are listed on this page.
Create a Precursor Intelligence account and track Edge. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.