Edge Chromium vulnerabilitiesAnd the versions its exploited flaws hit.
Edge Chromium is made by Microsoft. We track 203 published vulnerabilities in it, across 383 versions. 8 of them are on the list of flaws known to be exploited, the newest added on 5 June 2025. If you run Edge Chromium, check your version against the exploited flaws below and patch those first.
The most recent Edge Chromium flaw added to the known-exploited list is CVE-2025-5419, on 5 June 2025. We keep watching the known-exploited list.
Which versions of Edge Chromium do the exploited flaws hit?
Each exploited flaw lists the versions it affects, usually as ranges. "before 137.0.3296.62" means every version up to, but not including, 137.0.3296.62. Find your version, then patch.
- CVE-2025-5419Exploited list, 5 Jun 2025
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
before 137.0.3296.62 - CVE-2024-7965Exploited list, 28 Aug 2024
Google Chromium V8 Inappropriate Implementation Vulnerability
before 128.0.2739.42 - CVE-2023-4762Exploited list, 6 Feb 2024
Google Chromium V8 Type Confusion Vulnerability
before 116.0.1938.76 - CVE-2023-6345Exploited list, 30 Nov 2023
Google Skia Integer Overflow Vulnerability
before 119.0.2151.97 - CVE-2023-5217Exploited list, 2 Oct 2023
Google Chromium libvpx Heap Buffer Overflow Vulnerability
116.0.5845.229117.0.5938.132 - CVE-2023-4863Exploited list, 13 Sep 2023
Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
before 116.0.1938.81 - CVE-2022-4135Exploited list, 28 Nov 2022
Google Chromium GPU Heap Buffer Overflow Vulnerability
before 107.0.5304.150 - CVE-2020-16009Exploited list, 3 Nov 2021
Google Chromium V8 Type Confusion Vulnerability
before 86.0.4240.183
Which Edge Chromium vulnerabilities are being exploited?
8 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 8.8Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 8.8Google Chromium V8 Inappropriate Implementation Vulnerability
Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 8.8Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page.
- 9.6Google Skia Integer Overflow Vulnerability
Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file.
- 8.8Google Chromium libvpx Heap Buffer Overflow Vulnerability
Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 8.8Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page.
- 9.6Google Chromium GPU Heap Buffer Overflow Vulnerability
Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.
- 8.8Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Which Edge Chromium flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
- 49%
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 49%
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 43%CVE-2023-6702High
Type confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 38%
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
- 32%CVE-2024-21388Medium
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- 32%
Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- 23%CVE-2021-21132Critical
Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted Chrome Extension.
- 20%
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file.
- 19%CVE-2021-21135Medium
Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Running Edge Chromium? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Matched to
- Edge Chromium on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 203 published vulnerabilities listed under the name Edge Chromium, across 383 versions. The most recent Edge Chromium flaw added to the known-exploited list is CVE-2025-5419, on 5 June 2025.
8 are on the list of flaws known to be exploited. The most recently added are CVE-2025-5419, CVE-2024-7965 and CVE-2023-4762.
Each flaw names its own versions, usually as ranges. The newest, CVE-2025-5419, affects before 137.0.3296.62. The versions for every exploited flaw are listed on this page.
Create a EdgeProtect account and track Edge Chromium. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.