Microsoft has patched five separate memory corruption vulnerabilities in the Stable channel of the Edge browser. The company released version 156.0.4314.56 on October 29 and version 156.0.4314.58 on October 30; both updates include security fixes from the Chromium project. All of the vulnerabilities are in the remote code execution class and require user interaction.
Which vulnerabilities were fixed
CVE-2026-83831 and CVE-2026-85890 are double free bugs, CVE-2026-85897 is a heap-based buffer overflow, and CVE-2026-85898 and CVE-2026-62765 are type confusion bugs. The first four vulnerabilities have a CVSS 3.1 score of 8.8; CVE-2026-62765 is calculated as 7.5.
Microsoft’s security bulletin lists all five vulnerabilities with an “Important” severity and a “Remote Code Execution” impact. The same bulletin marks the exploitation likelihood as “Exploitation Less Likely”, meaning low likelihood. The company has not seen evidence that the vulnerabilities are being actively exploited.
Why it matters
These kinds of memory errors cause corruption in the browser’s own process. For an attacker to exploit this, the user needs to open a crafted page; the “UI:R” in the CVSS vector describes exactly that. The reason the score comes out to 8.8 is that a successful exploit is considered to have a high impact on confidentiality, integrity, and availability.
Edge’s use of the Chromium infrastructure brings the browser into the same bug family as Chrome. However, these five CVEs are separate entries from the Chrome vulnerabilities Google fixed on October 30. In other words, having updated Chrome does not close these vulnerabilities on the Edge side.
How to update
On most installations, Edge updates itself in the background. To verify the version, type edge://settings/help into the address bar. If you see 156.0.4314.58 or a newer number, the device is up to date. If you see an older version, click the “Check for updates” button on the same screen and restart the browser; the downloaded update only takes effect after a restart.
In enterprise environments, update distribution is usually handled with centralized tools, so the IT team needs to check the version. For home users, there is no extra step: closing and reopening the browser is enough.
None of the five vulnerabilities are currently on active exploitation lists. Still, the situation can change quickly with browser vulnerabilities; checking the version number takes only a few seconds.
Source: Microsoft MSRC · Edge security release notes
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.