# Multiple Vulnerabilities in Microsoft Edge prior to 154.0.4258.53 (HK GovCERT A26-10-03)

> Hong Kong GovCERT reports 37 CVEs fixed in Microsoft Edge 154.0.4258.53 (Chromium-sourced), with potential impact including remote code execution, denial of service, information disclosure, security restriction bypass, spoofing and tampering. No in-the-wild exploitation is reported; users should update to 154.0.4258.53 or later.

- **Published:** 2026-10-02T00:00:00Z
- **Last reviewed:** 2026-10-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2838
- **ID:** TL-2026-2838
- **Severity:** CRITICAL (CVSS 9.6)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-85047, CVE-2026-87438, CVE-2026-87464, CVE-2026-87481, CVE-2026-87482, CVE-2026-87483, CVE-2026-87486, CVE-2026-87488, CVE-2026-87503, CVE-2026-87517, CVE-2026-87518, CVE-2026-87520, CVE-2026-87522, CVE-2026-87534, CVE-2026-87545, CVE-2026-87552, CVE-2026-87555, CVE-2026-87576, CVE-2026-87595, CVE-2026-87597, CVE-2026-87640, CVE-2026-87643, CVE-2026-93372, CVE-2026-93373, CVE-2026-93374, CVE-2026-93375, CVE-2026-93376, CVE-2026-93377, CVE-2026-93378, CVE-2026-93379, CVE-2026-93380, CVE-2026-93381, CVE-2026-93382, CVE-2026-93383, CVE-2026-93385, CVE-2026-93386, CVE-2026-93387

## Description

On 2026-10-02 Hong Kong GovCERT published Security Alert A26-10-03 covering multiple vulnerabilities in Microsoft Edge prior to version 154.0.4258.53. The advisory lists 37 CVE identifiers (CVE-2026-85047, CVE-2026-87438, CVE-2026-87464, CVE-2026-87481 to -87483, -87486, -87488, -87503, -87517, -87518, -87520, -87522, -87534, -87545, -87552, -87555, -87576, -87595, -87597, -87640, -87643, CVE-2026-93372 to -93383 and CVE-2026-93385 to -93387) and states that successful exploitation could lead to remote code execution, denial of service, information disclosure, security restriction bypass, spoofing or tampering. The recommended action is to update Microsoft Edge to 154.0.4258.53 or later.

Microsoft's Edge security release notes show 154.0.4258.53 (Stable) was released 2026-10-01, after 154.0.4258.48 on 2026-09-29, and that it incorporates the latest Chromium security updates. At the time of the notes, no CVEs were yet listed for that build and no zero-day or exploited-in-the-wild flag was noted; Microsoft points to the Security Update Guide for CVE detail.

NVD records for a sample of the listed CVEs show they are Chromium/Google Chrome issues whose NVD descriptions are scoped to Chrome fixed versions 152.0.7977.82, 153.0.8010.36 and 153.0.8010.52 (several on Android or iOS). Examples: CVE-2026-85047 (improper input validation in Transactions Platform, Chrome iOS < 152.0.7977.82, CWE-20, CVSS 9.6, sandbox escape via crafted HTML page); CVE-2026-87438 (out-of-bounds write in WebGL, Chrome Android < 153.0.8010.36, CWE-787, CVSS 9.6); CVE-2026-87464 (use-after-free in WebGL, Chrome < 153.0.8010.36, CWE-416, CVSS 9.6); CVE-2026-93372 (WebGL buffer overflow, Chrome Android < 153.0.8010.52, CWE-121, CVSS 9.6); CVE-2026-87517 (race condition origin-policy bypass, iOS, CVSS 3.1); CVE-2026-87545 (information disclosure, iOS Mobile component, CWE-200, CVSS 6.5); CVE-2026-87640 (out-of-bounds read in WebView, Android, CWE-125, CVSS 6.1); CVE-2026-93380 (FileSystem race condition by a compromised renderer, CWE-367, CVSS 3.1). Only a subset of the 37 CVEs was individually checked; the rest are taken from the GovCERT list. The severity mix is wide, from Low to Critical.

None of the sampled CVEs appear in the CISA Known Exploited Vulnerabilities catalog. The KEV feed does contain two September 2026 Chromium V8 entries (CVE-2026-87491, CVE-2026-85046) that are not in this advisory's CVE list. Chrome 154 itself shipped on 2026-09-22 (154.0.8037.57/.58) with 108 security fixes, 11 rated Critical, mainly in ANGLE, GPU and WebGL; those CVE ids (e.g. CVE-2026-95350) are distinct from this advisory's list. The advisory contains no network IOCs, malware or actor attribution, so the IOC set here consists of affected product, version and component indicators for exposure and patch-compliance hunting.

## MITRE ATT&CK

- T1203 Exploitation for Client Execution
- T1204.001 User Execution: Malicious Link
- T1499.004 Endpoint Denial of Service: Application or System Exploitation

## Sources

- [HK GovCERT Security Alert (A26-10-03): Multiple Vulnerabilities in Microsoft Edge](https://www.govcert.gov.hk/en/alerts_detail.php?id=2092)
- [Microsoft Edge Release Notes (Security) - October 01, 2026](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security)
- [Microsoft Security Update Guide](https://msrc.microsoft.com/update-guide)
- [NVD - CVE-2026-85047](https://nvd.nist.gov/vuln/detail/CVE-2026-85047)
- [NVD - CVE-2026-87438](https://nvd.nist.gov/vuln/detail/CVE-2026-87438)
- [NVD - CVE-2026-93372](https://nvd.nist.gov/vuln/detail/CVE-2026-93372)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [Chrome Releases - Stable Channel Update for Desktop](https://chromereleases.googleblog.com/)
- [Update Chrome: 108 security fixes for desktop, new release for Android (Malwarebytes)](https://www.malwarebytes.com/blog/bugs/2026/09/update-chrome-108-security-fixes-for-desktop-new-release-for-android)
- [Chrome 153 Stable Arrives With 230 Security Fixes](https://www.technobezz.com/news/chrome-153-stable-security-update)
- [Google Chrome 154 Fixes 108 Security Flaws: 11 Are Rated Critical (TechRepublic)](https://www.techrepublic.com/article/news-google-chrome-154-108-security-flaws/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2838