Microsoft Edge (Chromium-based): Information disclosure via out-of-bounds read

Summary

An out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized remote attacker to disclose information. The attack requires the victim to visit attacker-controlled web content or open a malicious link, so user interaction is needed. The CVSS 3.1 score of 6.5 reflects high confidentiality impact only, with no integrity or availability impact.

Affected

• Microsoft Edge (Chromium-based) from 1.0.0.0 before 156.0.4314.42 (per CNA record)
• Other sources give different ranges and build numbers; see recommendation.

Fixed in

• Microsoft Edge 156.0.4314.42 (per CNA record)
• HKCERT references 157.0.4341.42 or later. The sources disagree; confirm the exact fixed build on the MSRC page.

Workaround

• Unknown. No interim mitigation or feature-based workaround has been identified. Installing the fixed Edge build is the remedy.

Exploitation

• No evidence of exploitation in the wild found (SANS ISC: Exploited No).
• Not listed in CISA KEV (per Strix).
• No public proof of concept found.
• VulDB rates exploitation as easy; this is an estimate, not evidence of an exploit.

Our recommendation

• Update Microsoft Edge to the latest build now, and confirm the fixed build on the MSRC page before rollout.
• Use managed update tools (Intune, WSUS or similar) to verify that all Edge clients report the fixed version.
• Include Edge in the normal browser update cycle rather than waiting for a quarterly cycle.
• Check NVD for final scoring once analysis is complete, and watch for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-122518 www.cve.org
• MSRC Security Update Guide – CVE-2026-122518 msrc.microsoft.com
• VulDB entry 435196 vuldb.com
• HKCERT security bulletin – Microsoft Edge multiple vulnerabilities (2026-11-09) www.hkcert.org
• BleepingComputer – Microsoft November 2026 Patch Tuesday www.bleepingcomputer.com
• Strix – CVE-2026-122518 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:03.