# Multiple Vulnerabilities in Microsoft Edge (prior to 157.0.4341.42) - 27 Chromium CVEs - HK GovCERT A26-11-10

> HK GovCERT alert A26-11-10 reports 27 vulnerabilities in Microsoft Edge prior to 157.0.4341.42 that a remote attacker could trigger by enticing a user to open a crafted web page, with potential for remote code execution, denial of service, information disclosure, security restriction bypass and tampering. Microsoft released Edge 157.0.4341.42 on 2026-11-05; no active exploitation or KEV listing was found.

- **Published:** 2026-11-06T11:16:27Z
- **Last reviewed:** 2026-11-06T11:16:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5408
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5408.png
- **ID:** TL-2026-5408
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 6
- **CVEs:** CVE-2026-76024, CVE-2026-76025, CVE-2026-76026, CVE-2026-76027, CVE-2026-76028, CVE-2026-76029, CVE-2026-76030, CVE-2026-76031, CVE-2026-110913, CVE-2026-110918, CVE-2026-110919, CVE-2026-110921, CVE-2026-110922, CVE-2026-118309, CVE-2026-119260, CVE-2026-119261, CVE-2026-119262, CVE-2026-119263, CVE-2026-119264, CVE-2026-119265, CVE-2026-119266, CVE-2026-119267, CVE-2026-119268, CVE-2026-119269, CVE-2026-119270, CVE-2026-119271, CVE-2026-119272

## Description

HK GovCERT published Security Alert A26-11-10 on 2026-11-06 covering Microsoft Edge (Chromium-based) versions prior to 157.0.4341.42. The alert lists CVE-2026-76024 to CVE-2026-76031, CVE-2026-110913, CVE-2026-110918 to CVE-2026-110919, CVE-2026-110921 to CVE-2026-110922, CVE-2026-118309 and CVE-2026-119260 to CVE-2026-119272. It states that an attacker could entice a user to open a web page with specially crafted content on a vulnerable browser, and that exploitation could result in remote code execution, denial of service, information disclosure, security restriction bypass or tampering. The alert gives no per-CVE descriptions, no CVSS scores and no exploitation status.

Microsoft's Edge security release notes state that Edge Stable 157.0.4341.42 (released 2026-11-05) incorporates the latest Chromium security updates; at the time of reading, the CVE list had not yet been added to the page. The CVEs are upstream Chromium flaws, and NVD describes them as Google Chrome issues fixed in Chrome 155.0.8059.84, 156.0.8078.73 and 156.0.8078.79.

Five of the 27 CVEs were checked in NVD. CVE-2026-76024 is a use-after-free in MediaStream (CWE-416, CVSS 6.5, fixed in Chrome 156.0.8078.79). CVE-2026-110913 is memory corruption in DOM (CWE-119, CVSS 8.8, fixed in Chrome 155.0.8059.84). CVE-2026-118309 is incorrect reference resolution in Android UI (CWE-706, CVSS 9.6, fixed in Chrome 156.0.8078.73), which only affects Chrome on Android. CVE-2026-119260 is a use-after-free in Frames (CWE-416, CVSS 8.8, fixed in Chrome 156.0.8078.79). CVE-2026-119272 is incorrect authorization in FileSystem (CWE-863, CVSS 4.3, fixed in Chrome 156.0.8078.79). The remaining 22 CVEs were not individually retrieved, so their components and scores are not stated here.

The code-execution CVEs checked are described as executing arbitrary code inside the browser sandbox, so a full system compromise would require chaining with a sandbox escape; no such chain is reported in the sources. No CVE in this set was found in the CISA KEV catalog, but only the first 100,000 characters of the feed were searched. No public PoC, exploitation in the wild, threat actor, malware or network infrastructure is reported. Severity HIGH is an analyst estimate based on the highest typical CVSS of 8.8 among the checked RCE-in-sandbox flaws. Administrators should update Edge to 157.0.4341.42 or later and verify that the browser relaunches.

## MITRE ATT&CK

- T1566.002 Phishing: Spearphishing Link
- T1203 Exploitation for Client Execution
- T1204.001 User Execution: Malicious Link

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5408 Edge (msedge.exe) Spawning Shell or Script Interpreter — Chromium Renderer Exploit Follow-on** (`TL-2026-5408-SPL-001`)

Detects msedge.exe launching cmd, PowerShell, wscript/cscript, mshta, rundll32 or regsvr32. The 27 Chromium CVEs in HK GovCERT A26-11-10 (e.g. CVE-2026-119260 Frames UAF, CVE-2026-110913 DOM memory corruption, CVE-2026-76024 MediaStream UAF) give code execution in the renderer sandbox from a crafted page; a browser that then spawns a shell or script host is a high-fidelity sign that the exploit chain progressed beyond the sandbox or that a user was lured into running content (T1203, T1204.001, T1059).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1204.001, T1059.001, T1059.003
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\msedge.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_images values(CommandLine) as child_cmdlines by host User ParentCommandLine
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "msedge.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessVersionInfoProductVersion, SHA256
```

### Sigma

```yaml
title: Microsoft Edge Spawning Shell or Script Interpreter
id: a3f1c2d4-5b6e-4f70-8a91-2c3d4e5f6a01
status: experimental
description: Detects msedge.exe spawning a command shell or script host, a follow-on indicator for exploitation of Chromium renderer flaws fixed in Edge 157.0.4341.42 (HK GovCERT A26-11-10).
references:
    - https://www.govcert.gov.hk/en/alerts_detail.php?id=2165
    - https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.execution
    - attack.t1203
    - attack.t1204.001
    - attack.t1059.001
    - attack.t1059.003
    - cve.2026.119260
    - cve.2026.110913
    - cve.2026.76024
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\msedge.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Enterprise web apps or extensions that launch helper scripts through Edge
    - Admins launching PowerShell via Edge-hosted portals or Intune tooling
level: high

```

**Known false positives:**

- Edge-integrated enterprise tooling or extensions launching helper scripts
- Developer/admin workflows that start PowerShell or cmd from Edge DevTools or portals

**Tuning notes:** Allowlist known ParentCommandLine values and approved helper scripts per host group. Add CommandLine filters for your management agents. Requires Sysmon Event 1 with Edge not excluded in the config; adjust the index name to your environment.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5408 Vulnerable Microsoft Edge Builds Below 157.0.4341.42 (27 Chromium CVEs) — Exposure Inventory (locked: unlock with TL Creds)
- TL-2026-5408 Non-Browser Child of msedge.exe at High/System Integrity — Possible Sandbox Escape (locked: unlock with TL Creds)
- TL-2026-5408 Link Opened in Edge From Outlook/Teams Followed by Edge-Spawned Shell Within 10 Minutes (locked: unlock with TL Creds)
- TL-2026-5408 Edge Launched With Sandbox or Site-Isolation Disabled Flags (locked: unlock with TL Creds)
- TL-2026-5408 msedge.exe Writing Executable or Script Files Outside Downloads and Edge Profile (locked: unlock with TL Creds)
- TL-2026-5408 Edge-Spawned Download Cradle or Encoded PowerShell Command Line (locked: unlock with TL Creds)
- TL-2026-5408 Repeated Edge (msedge.exe) Crashes — Memory-Corruption Exploit Attempt / DoS (locked: unlock with TL Creds)
- TL-2026-5408 Process Launched From Downloads/Temp/Public With msedge.exe Parent — Drive-By Payload Execution (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [HK GovCERT Security Alert A26-11-10: Multiple Vulnerabilities in Microsoft Edge](https://www.govcert.gov.hk/en/alerts_detail.php?id=2165)
- [Release notes for Microsoft Edge Security Updates (157.0.4341.42)](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security)
- [Microsoft Security Update Guide](https://msrc.microsoft.com/update-guide)
- [NVD: CVE-2026-119260 (Use after free in Frames)](https://nvd.nist.gov/vuln/detail/CVE-2026-119260)
- [NVD: CVE-2026-76024 (Use after free in MediaStream)](https://nvd.nist.gov/vuln/detail/CVE-2026-76024)
- [NVD: CVE-2026-110913 (Memory corruption in DOM)](https://nvd.nist.gov/vuln/detail/CVE-2026-110913)
- [NVD: CVE-2026-118309 (Incorrect reference resolution in Android UI)](https://nvd.nist.gov/vuln/detail/CVE-2026-118309)
- [NVD: CVE-2026-119272 (Incorrect authorization in FileSystem)](https://nvd.nist.gov/vuln/detail/CVE-2026-119272)
- [Chrome Releases blog](https://chromereleases.googleblog.com/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5408