Critical code vulnerability patched in Edge on iPhone

Microsoft has patched a security vulnerability in the Edge browser for iPhone and iPad that could lead to remote code execution. The bug, tracked as CVE-2026-96192, is a use-after-free flaw (CWE-416). The company classified the vulnerability as “Important” in its October 26, 2026 bulletin and announced the fixed build as 155.0.4283.45.

How the vulnerability is triggered

The CVSS 3.1 score in the NVD record is 8.8, which is high risk. The vector string shows that the attack comes over the network, has low complexity, and does not require privileges from the attacker. On the other hand, user interaction is required: according to Microsoft’s description in the bulletin, the user must tap a crafted link for the attack to begin. In short, tapping the wrong link while Edge is open on your phone can allow the attacker to execute code remotely.

Use-after-free bugs occur when the same memory area is rewritten after an object has been deleted. When an attacker fills that area with their own data, the application can transfer control to an unexpected location. Browsers are among the software categories where these bugs are most common, because they process foreign content continuously throughout the day.

Which versions are affected

The NVD configuration record lists Edge for iOS installations with version numbers below 155.0.4283.45 as affected. Microsoft also gives the fixed build with the same number. So if the Edge app on your phone is below this version, the vulnerability is still present.

On iPhone and iPad, apps are updated through the App Store. It is enough to go to the Edge page in the App Store and check the version number; if you see 155.0.4283.45 or higher, you have the update. If automatic updates are enabled, the new version is usually installed in the background, but the app needs to be closed and reopened once.

No known active exploitation

Microsoft’s bulletin states that the vulnerability has not been publicly disclosed and that there is no information indicating it is being actively exploited. The vulnerability is also not on CISA’s KEV list, so there is no mandatory patching deadline for federal agencies. This does not mean the risk is zero: browser vulnerabilities can still be used in attack attempts after a patch is released, and older versions left on devices become targets.

What to do

Updating Edge from the App Store is the first step. Then leaving automatic updates enabled helps ensure the same vulnerability is quietly patched in the future. Being careful with shortened links and ad redirects from unknown sources also makes it harder to trigger these kinds of bugs. If you use Edge heavily on your phone, you can check the version in a few seconds and be done.

Source: MSRC · NVD