VULNpocalypse
MediumVulnerabilityPatch available

HKCERT reports multiple Microsoft Edge flaws, fixed in 157.0.4341.42

HKCERT reports multiple Microsoft Edge vulnerabilities, including possible remote code execution; it advises updating to 157.0.4341.42 or later.

Published
Fixed in
Microsoft Edge 157.0.4341.42 or later
Exploitation
Not confirmed. The HKCERT bulletin does not say whether any of these vulnerabilities are exploited in the wild.

Live scores

CVE-2026-76024
EPSS
0.003
low predicted chance of attack
VEDAS
0.948
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-76025
EPSS
0.003
low predicted chance of attack
VEDAS
0.948
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-76026
EPSS
0.002
low predicted chance of attack
VEDAS
0.950
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-76027
EPSS
0.002
low predicted chance of attack
VEDAS
0.946
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-76028
EPSS
0.002
low predicted chance of attack
VEDAS
0.955
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-76029
EPSS
0.002
low predicted chance of attack
VEDAS
0.950
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-76030
EPSS
0.002
low predicted chance of attack
VEDAS
0.952
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-76031
EPSS
0.003
low predicted chance of attack
VEDAS
0.949
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-119260
EPSS
0.002
low predicted chance of attack
VEDAS
0.953
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-119261
EPSS
0.003
low predicted chance of attack
VEDAS
0.949
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-119262
EPSS
0.003
low predicted chance of attack
VEDAS
0.950
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-119263
EPSS
0.003
low predicted chance of attack
VEDAS
0.950
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-119264
EPSS
0.002
low predicted chance of attack
VEDAS
0.957
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-119265
EPSS
0.002
low predicted chance of attack
VEDAS
0.945
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-119266
EPSS
0.003
low predicted chance of attack
VEDAS
0.949
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-119267
EPSS
0.002
low predicted chance of attack
VEDAS
0.958
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-119268
EPSS
0.002
low predicted chance of attack
VEDAS
0.946
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-119269
EPSS
0.002
low predicted chance of attack
VEDAS
0.948
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-119270
EPSS
0.002
low predicted chance of attack
VEDAS
0.954
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-119271
EPSS
0.002
low predicted chance of attack
VEDAS
0.948
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-119272
EPSS
0.002
low predicted chance of attack
VEDAS
0.948
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-122518
EPSS
0.009
low predicted chance of attack
VEDAS
0.048
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

What happened

According to HKCERT, multiple vulnerabilities were identified in Microsoft Edge, and it rates the bulletin “Medium Risk” (HKCERT). HKCERT published the bulletin on 9 Nov 2026 and says a remote attacker could exploit some of these vulnerabilities to cause denial of service, bypass security restrictions, disclose sensitive information or execute code remotely on the targeted system (HKCERT).

HKCERT lists 22 identifiers (HKCERT):

Not confirmed: the bulletin does not map individual CVEs to impact types, give severity scores per CVE, describe the affected components, or say whether any flaw is exploited in the wild. HKCERT names Microsoft Edge as its source and points to the Microsoft Edge security release notes (entry “November 05, 2026”) as a related link, but that page is not among the sources used here.

Am I affected?

According to HKCERT, affected systems are Microsoft Edge versions prior to 157.0.4341.42 (HKCERT). HKCERT classifies the bulletin as type “Clients - Browsers”. If your Edge is at 157.0.4341.42 or later, it is outside the affected range described by HKCERT. Details for other platforms, channels or Chromium-based products are not confirmed in the bulletin.

What to do now

  1. Check the installed Edge version on your devices (in the browser, open the About page for Microsoft Edge).
  2. If it is older than 157.0.4341.42, update to 157.0.4341.42 or later, as HKCERT advises (HKCERT).
  3. HKCERT asks readers to visit the software vendor’s website for more details before installing; use the vendor’s own release notes to confirm the fixes for each CVE.
  4. For managed fleets, confirm through your normal deployment tooling that the updated version has reached all endpoints.

Sources