Multiple Vulnerabilities in Microsoft Edge (prior to 157.0.4341.42) - 27 Chromium CVEs - HK GovCERT A26-11-10

Key facts for Edge 157 Chromium flaws

Detection coverage for Edge 157 Chromium flaws

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5408 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5408 Edge (msedge.exe) Spawning Shell or Script Interpreter — Chromium Renderer Exploit Follow-on

Detects msedge.exe launching cmd, PowerShell, wscript/cscript, mshta, rundll32 or regsvr32. The 27 Chromium CVEs in HK GovCERT A26-11-10 (e.g. CVE-2026-119260 Frames UAF, CVE-2026-110913 DOM memory corruption, CVE-2026-76024 MediaStream UAF) give code execution in the renderer sandbox from a crafted page; a browser that then spawns a shell or script host is a high-fidelity sign that the exploit chain progressed beyond the sandbox or that a user was lured into running content (T1203, T1204.001, T1059).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1204.001, T1059.001, T1059.003
• Data sources: sysmon, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\msedge.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_images values(CommandLine) as child_cmdlines by host User ParentCommandLine
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "msedge.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessVersionInfoProductVersion, SHA256

Sigma

title: Microsoft Edge Spawning Shell or Script Interpreter
id: a3f1c2d4-5b6e-4f70-8a91-2c3d4e5f6a01
status: experimental
description: Detects msedge.exe spawning a command shell or script host, a follow-on indicator for exploitation of Chromium renderer flaws fixed in Edge 157.0.4341.42 (HK GovCERT A26-11-10).
references:
    - https://www.govcert.gov.hk/en/alerts_detail.php?id=2165
    - https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.execution
    - attack.t1203
    - attack.t1204.001
    - attack.t1059.001
    - attack.t1059.003
    - cve.2026.119260
    - cve.2026.110913
    - cve.2026.76024
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\msedge.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Enterprise web apps or extensions that launch helper scripts through Edge
    - Admins launching PowerShell via Edge-hosted portals or Intune tooling
level: high

Known false positives:

• Edge-integrated enterprise tooling or extensions launching helper scripts
• Developer/admin workflows that start PowerShell or cmd from Edge DevTools or portals

Tuning notes: Allowlist known ParentCommandLine values and approved helper scripts per host group. Add CommandLine filters for your management agents. Requires Sysmon Event 1 with Edge not excluded in the config; adjust the index name to your environment.

• 🔒 TL-2026-5408 Vulnerable Microsoft Edge Builds Below 157.0.4341.42 (27 Chromium CVEs) — Exposure Inventory · unlock with TL Creds
• 🔒 TL-2026-5408 Non-Browser Child of msedge.exe at High/System Integrity — Possible Sandbox Escape · unlock with TL Creds
• 🔒 TL-2026-5408 Link Opened in Edge From Outlook/Teams Followed by Edge-Spawned Shell Within 10 Minutes · unlock with TL Creds
• 🔒 TL-2026-5408 Edge Launched With Sandbox or Site-Isolation Disabled Flags · unlock with TL Creds
• 🔒 TL-2026-5408 msedge.exe Writing Executable or Script Files Outside Downloads and Edge Profile · unlock with TL Creds
• 🔒 TL-2026-5408 Edge-Spawned Download Cradle or Encoded PowerShell Command Line · unlock with TL Creds
• 🔒 TL-2026-5408 Repeated Edge (msedge.exe) Crashes — Memory-Corruption Exploit Attempt / DoS · unlock with TL Creds
• 🔒 TL-2026-5408 Process Launched From Downloads/Temp/Public With msedge.exe Parent — Drive-By Payload Execution · unlock with TL Creds

Indicators of compromise for Edge 157 Chromium flaws

As of 2026-11-06, Threadlinqs Intelligence tracks 6 indicators of compromise for TL-2026-5408.

How Edge 157 Chromium flaws works

Microsoft released Edge 157.0.4341.42 on 2026-11-05; no active exploitation or KEV listing was found.

HK GovCERT published Security Alert A26-11-10 on 2026-11-06 covering Microsoft Edge (Chromium-based) versions prior to 157.0.4341.42. The alert lists CVE-2026-76024 to CVE-2026-76031, CVE-2026-110913, CVE-2026-110918 to CVE-2026-110919, CVE-2026-110921 to CVE-2026-110922, CVE-2026-118309 and CVE-2026-119260 to CVE-2026-119272. It states that an attacker could entice a user to open a web page with specially crafted content on a vulnerable browser, and that exploitation could result in remote code execution, denial of service, information disclosure, security restriction bypass or tampering. The alert gives no per-CVE descriptions, no CVSS scores and no exploitation status.

Microsoft's Edge security release notes state that Edge Stable 157.0.4341.42 (released 2026-11-05) incorporates the latest Chromium security updates; at the time of reading, the CVE list had not yet been added to the page. The CVEs are upstream Chromium flaws, and NVD describes them as Google Chrome issues fixed in Chrome 155.0.8059.84, 156.0.8078.73 and 156.0.8078.79.

Five of the 27 CVEs were checked in NVD. CVE-2026-76024 is a use-after-free in MediaStream (CWE-416, CVSS 6.5, fixed in Chrome 156.0.8078.79). CVE-2026-110913 is memory corruption in DOM (CWE-119, CVSS 8.8, fixed in Chrome 155.0.8059.84). CVE-2026-118309 is incorrect reference resolution in Android UI (CWE-706, CVSS 9.6, fixed in Chrome 156.0.8078.73), which only affects Chrome on Android. CVE-2026-119260 is a use-after-free in Frames (CWE-416, CVSS 8.8, fixed in Chrome 156.0.8078.79). CVE-2026-119272 is incorrect authorization in FileSystem (CWE-863, CVSS 4.3, fixed in Chrome 156.0.8078.79). The remaining 22 CVEs were not individually retrieved, so their components and scores are not stated here.

The code-execution CVEs checked are described as executing arbitrary code inside the browser sandbox, so a full system compromise would require chaining with a sandbox escape; no such chain is reported in the sources. No CVE in this set was found in the CISA KEV catalog, but only the first 100,000 characters of the feed were searched. No public PoC, exploitation in the wild, threat actor, malware or network infrastructure is reported. Severity HIGH is an analyst estimate based on the highest typical CVSS of 8.8 among the checked RCE-in-sandbox flaws. Administrators should update Edge to 157.0.4341.42 or later and verify that the browser relaunches.

MITRE ATT&CK techniques by tactic:

Execution

T1203 Exploitation for Client Execution; T1204.001 User Execution: Malicious Link

Initial Access

T1566.002 Phishing: Spearphishing Link

Remediation for Edge 157 Chromium flaws

Patches

• Microsoft Edge Stable 157.0.4341.42 (released 2026-11-05)

Immediate actions

• Update Microsoft Edge to 157.0.4341.42 or later on all endpoints
• Restart Edge so the update takes effect and confirm the version at edge://settings/help

Workarounds

• Avoid opening untrusted links or web pages in unpatched browsers until updated
• Use Edge enhanced security mode or application isolation where available

Longer-term hardening

• Enable automatic Edge updates and monitor Edge version compliance in endpoint management
• Keep other Chromium-based browsers (Chrome, Brave, Opera, Vivaldi) on current stable builds

Affected and fixed versions

• Microsoft — Microsoft Edge (Chromium-based)
  Vulnerable versions: prior to 157.0.4341.42
  Fixed in: 157.0.4341.42 and later
• Google — Google Chrome (upstream Chromium flaws)
  Vulnerable versions: prior to 155.0.8059.84; prior to 156.0.8078.73 (Android); prior to 156.0.8078.79
  Fixed in: 155.0.8059.84; 156.0.8078.73; 156.0.8078.79

Timeline of Edge 157 Chromium flaws

• 2026-10-15 NVD publishes CVE-2026-110913 (DOM memory corruption), fixed in Chrome 155.0.8059.84, the earliest-dated CVE in the alert that was checked
• 2026-10-27 NVD publishes CVE-2026-118309 (Android UI incorrect reference resolution, CVSS 9.6), fixed in Chrome 156.0.8078.73
• 2026-10-30 NVD publishes CVE-2026-76024, CVE-2026-119260 and CVE-2026-119272, fixed in Chrome 156.0.8078.79
• 2026-11-04 Chrome Releases blog posts an Early Stable update for Desktop
• 2026-11-05 Microsoft releases Edge Stable 157.0.4341.42 with the latest locked-ioc-6 security updates; CVEs to be added to the release notes as available
• 2026-11-06 locked-ioc-5 publishes Security Alert A26-11-10 listing 27 CVEs and advising users to update Edge to 157.0.4341.42 or later

Sources cited for Edge 157 Chromium flaws

• HK GovCERT Security Alert A26-11-10: Multiple Vulnerabilities in Microsoft Edge govcert.gov.hk · Advisory · 2026-11-06
• NVD: CVE-2026-119260 (Use after free in Frames) NVD (NIST) · Advisory · 2026-10-30
• NVD: CVE-2026-76024 (Use after free in MediaStream) NVD (NIST) · Advisory · 2026-10-30
• NVD: CVE-2026-110913 (Memory corruption in DOM) NVD (NIST) · Advisory · 2026-10-15
• NVD: CVE-2026-118309 (Incorrect reference resolution in Android UI) NVD (NIST) · Advisory · 2026-10-27
• NVD: CVE-2026-119272 (Incorrect authorization in FileSystem) NVD (NIST) · Advisory · 2026-10-30
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-11-06
• Release notes for Microsoft Edge Security Updates (157.0.4341.42) Microsoft · Vendor report · 2026-11-05
• Microsoft Security Update Guide Microsoft Security Response Center · Vendor report · 2026-11-05
• Chrome Releases blog chromereleases.googleblog.com · Vendor report · 2026-10-30

More in vulnerability

• Metasploit 6.5.9 Wrapup: Public Exploit Modules for Citrix NetScaler (CVE-2026-88771), Cisco Secure Email Gateway (CVE-2026-76461/76443), GitLab CI/CD Regex RCE (CVE-2026-97229), OpenBullet2, Flowise, SPIP and WordPress Bug Library
• CVE-2026-113618: Improper Certificate Validation in KAMSOFT ZSIRep CLIENT library
• D-Link DGS-3130 Series Switches: Multiple Unpatched Zero-Days in D-Link Discovery Protocol (DDP) and Firmware (D-Link SAP10523, CVEs Pending)
• Apple September 2026 Security Updates: 273 CVEs incl. actively exploited Screen Sharing auth bypass (CVE-2026-65400) and critical Bluetooth RCE (CVE-2026-65414)
• OpenAI GPT-6 Cyber Identifies 81 Previously Unknown High-Severity Firefox Vulnerabilities (Mozilla MFSA2026-118, Firefox 159)