Microsoft Edge Patches Nine Chromium Security Vulnerabilities Including Multiple Memory Flaws

Microsoft Edge has addressed nine Chromium security vulnerabilities, most involving dangerous memory-management flaws across browser components.

Nine security vulnerabilities have been patched in Microsoft Edge's Chromium-based browser, with the majority classified as memory-management flaws that can be exploited to execute malicious code. The affected components span a wide range of browser functions, including WebGL, GPU processing, HTML rendering, the Translate feature, the Views interface layer, the Aura windowing system, and the CrashReporting and CredentialProvider subsystems. The vulnerability types include seven 'use after free' bugs, one heap buffer overflow, one race condition, and one uninitialized memory use — all categories commonly associated with elevated security risk in browser environments. The CVEs are numbered CVE-2026-19137 through CVE-2026-19147 and were originally assigned by Google Chrome, which develops the underlying Chromium engine. Because Edge ingests Chromium, Microsoft's browser inherits both the vulnerabilities and the fixes when Google publishes updated Chromium releases. No technical exploitation details or severity ratings were included in the published advisories.

Why it matters

Use-after-free and heap buffer overflow vulnerabilities in browsers are frequently targeted by attackers to achieve remote code execution, making timely patching important for all Edge and Chrome users. The breadth of affected components — from GPU handling to credential management — means the attack surface is relatively wide.

What's next

Users should ensure Microsoft Edge and Google Chrome are updated to the latest available versions to receive these fixes.

Key facts

• Nine CVEs were disclosed: CVE-2026-19137, 19138, 19139, 19140, 19142, 19144, 19145, 19146, and 19147
• Seven of the nine flaws are 'use after free' vulnerabilities, a class frequently exploitable for code execution
• Additional flaw types include one heap buffer overflow (CrashReporting), one race condition (CredentialProvider), and one uninitialized memory use (GPU)
• Affected components include WebGL, GPU, HTML, Translate, Views, Aura, CrashReporting, and CredentialProvider
• All CVEs were originally assigned by Google Chrome and inherited by Microsoft Edge through its Chromium base
• No CVSS severity scores or active exploitation reports were included in the published advisories

Bias & framing notes

All nine vulnerability sources are bare-minimum CVE advisories from vulners.com with no severity ratings, proof-of-concept details, or independent corroboration. The disclosures are consistent with standard Microsoft Edge security update language, which raises baseline credibility, but the absence of any additional reporting or official severity classification limits confidence in completeness.

NewsClear — neutral news & congressional tracking · Bill of the Week