Multiple vulnerabilities in Microsoft Edge (July 7, 2026)
Multiple vulnerabilities have been discovered in Microsoft Edge. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and a breach of data confidentiality.
CSIRTS triage
- What
- Multiple vulnerabilities allow remote arbitrary code execution, privilege escalation, and data confidentiality breaches.
- Who is affected
- Users of Microsoft Edge are affected by these vulnerabilities.
- Urgency
- Remediation is urgent due to the potential for severe exploitation.
- Action
- Update Microsoft Edge to the latest version to address these vulnerabilities.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Microsoft Edge
Get an email when a new Microsoft Edge advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0840/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-138480.44% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-140980.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-579880.53% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-141040.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-139340.41% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-140800.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-138060.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-141000.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-139330.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-582910.59% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
Referenced CVEs
+12 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownMultiple vulnerabilities in Palo Alto Networks products (August 13, 2026)cert-fr-avis
- highPAN-SA-2026-0011 Chromium: Monthly Vulnerability Update (August 2026) (Severity: HIGH)paloalto
- high[UPDATE] [high] Google Chrome: Multiple vulnerabilities allow unspecified attackcert-bund
- unknownCVE-2026-14063: Chromium: CVE-2026-14063 Out of bounds memory access in Chromecastmsrc
- unknownCVE-2026-13950: Chromium: CVE-2026-13950 Uninitialized Use in GPUmsrc
- unknownCVE-2026-14134: Chromium: CVE-2026-14134 Inappropriate implementation in Autofillmsrc
- unknownCVE-2026-13984: Chromium: CVE-2026-13984 Incorrect security UI in TabStripmsrc
- highCVE-2026-57992: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerabilitymsrc
- mediumCVE-2026-58291: Microsoft Edge (Chromium-based) Information Disclosure Vulnerabilitymsrc
- unknownCVE-2026-14100: Chromium: CVE-2026-14100 Insufficient data validation in NetworkCachemsrc
- highCVE-2026-57991: Microsoft Edge (Chromium-based) Information Disclosure Vulnerabilitymsrc
- unknownCVE-2026-13838: Chromium: CVE-2026-13838 Inappropriate implementation in CSSmsrc
Recent advisories for Microsoft Edge
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownMicrosoft Edge Multiple Vulnerabilitieshkcert · 2026-08-24
- unknownMultiple vulnerabilities in Microsoft Edge (August 21, 2026)cert-fr-avis · 2026-08-21
- unknownMicrosoft Edge security advisory (AV26-822)cccs · 2026-08-17
- high[NEW] [high] Microsoft Edge: Vulnerability enables code executioncert-bund · 2026-08-17
- unknownMicrosoft Edge Multiple Vulnerabilitieshkcert · 2026-08-17
- unknownMultiple vulnerabilities in Microsoft Edge (August 17, 2026)cert-fr-avis · 2026-08-17
More from CERT-FR Avis de sécurité
- unknownMultiple vulnerabilities in Keycloak (August 25, 2026)2026-08-25
- unknownMultiple vulnerabilities in Cisco IOS XE (August 25, 2026)2026-08-25
- unknownMultiple vulnerabilities in LibreNMS (August 24, 2026)2026-08-24
- unknownMultiple vulnerabilities in Metabase (August 24, 2026)2026-08-24
- unknownVulnerability in SPIP (August 21, 2026)2026-08-21