> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Microsoft Edge batch update addresses 38+ CVEs in Oct 2026 patch - URL: https://f4n6.co.uk/security-feed/microsoft-edge-batch-update-addresses-38-cves-in-oct-2026-patch/ - Published: 2026-10-23T18:14:05.000Z - Updated: 2026-10-23T18:14:05.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-112992, CVE-2026-112993, CVE-2026-112994, CVE-2026-112995, CVE-2026-112996 ## 1\. Executive summary CERT-FR published advisory CERTFR-2026-AVI-1371 on 23 October 2026 covering multiple vulnerabilities in Microsoft Edge versions earlier than 156.0.4314.42, with Microsoft security updates dated 22 October 2026\. The advisory lists 353 CVE identifiers; the ten CVEs with NVD records in the verified data carry CVSS 9.6 (CVE-2026-112992, CWE-119) and CVSS 8.8 for the remaining nine (CWE-119 and CWE-416). None of the ten is in CISA KEV and all have EPSS 0%, so there is no evidence of exploitation in the wild for those records. CERT-FR classifies the risk as "non spécifié par l'éditeur", meaning Microsoft has not published the impact class for this batch, and the affected population is every EMEA financial services estate running Edge on managed endpoints, VDI and kiosk builds below 156.0.4314.42\. The bottom line is a high-volume, high-severity browser patch with no confirmed exploitation: treat it as a scheduled emergency change, not a fire drill. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | The patch requires an ICT-related incident management process to schedule, test and roll out a browser update across managed endpoints within the change window | The change must be logged and tracked through the firm's ICT incident and change process, with rollback evidence retained | | NIS2 Art. 21(2)(d) | Edge is# Advisory AT-2026-10-23-1498: Microsoft Edge batch update addresses 38+ CVEs in Oct 2026 patch | | ## 1\. Executive summary CERT-FR published advisory CERTFR-2026-AVI-1371 on 23 October 2026 covering multiple vulnerabilities in Microsoft Edge versions earlier than 156.0.4314.42, with Microsoft security updates dated 22 October 2026\. The advisory lists 353 CVE identifiers; the ten CVEs with NVD records in the verified data carry CVSS 9.6 (CVE-2026-112992, CWE-119) and CVSS 8.8 for the remaining nine (CWE-119 and CWE-416). None of the ten is in CISA KEV and all have EPSS 0%, so there is no evidence of exploitation in the wild for those records. CERT-FR classifies the risk as "non spécifié par l'éditeur", meaning Microsoft has not published the impact class for this batch, and the affected population is every EMEA financial services estate running Edge on managed endpoints, VDI and kiosk builds below 156.0.4314.42\. The bottom line is a high-volume, high-severity browser patch with no confirmed exploitation: treat it as a scheduled emergency change, not a fire drill. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | The patch requires an ICT-related incident management process to schedule, test and roll out a browser update across managed endpoints within the change window | The change must be logged and tracked through the firm's ICT incident and change process, with rollback evidence retained | | NIS2 Art. 21(2)(d) | Edge is a third-party component in the endpoint software supply chain, and the update must be pushed through the firm's managed software distribution channel | Supply chain security measures must cover the integrity and provenance of the Edge update package before it is deployed | | UK NIS 2018 | Where the firm is an OES or RDSP, the browser update falls within the duty to manage risks to the network and information systems that deliver the essential or digital service | The update must be evidenced in the firm's risk management records for the regulated service | ## 3\. Technical analysis & attack chain CERT-FR does not publish an attack chain for this item. The advisory states only that multiple vulnerabilities were discovered in Microsoft Edge, that they allow an attacker to cause a security problem not specified by the publisher, and that affected systems are Edge versions earlier than 156.0.4314.42\. No exploitation steps, initial access vector, payload, persistence mechanism, privilege escalation path, command-and-control channel, lateral movement or data access is described in the source. The verified data adds the following per-CVE mechanism classifications for the ten CVEs with NVD records: | CVE | CVSS | Severity | CWE | KEV | EPSS | | --------------- | ---- | -------- | --------------------------------------------------------------------------------- | --- | ---- | | CVE-2026-112992 | 9.6 | CRITICAL | CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) | No | 0% | | CVE-2026-112993 | 8.8 | HIGH | CWE-416 (Use After Free) | No | 0% | | CVE-2026-112994 | 8.8 | HIGH | CWE-119 | No | 0% | | CVE-2026-112995 | 8.8 | HIGH | CWE-416 | No | 0% | | CVE-2026-112996 | 8.8 | HIGH | CWE-119 | No | 0% | | CVE-2026-112997 | 8.8 | HIGH | CWE-119 | No | 0% | | CVE-2026-112998 | 8.8 | HIGH | CWE-119 | No | 0% | | CVE-2026-112999 | 8.8 | HIGH | CWE-416 | No | 0% | | CVE-2026-113000 | 8.8 | HIGH | CWE-119 | No | 0% | | CVE-2026-113001 | 8.8 | HIGH | CWE-416 | No | 0% | The remaining 343 CVE identifiers listed in the CERT-FR advisory have no NVD record in the verified data, so no CVSS, CWE, KEV or EPSS value is available for them. The advisory does not state which Edge component (V8, Blink, Skia, WebAssembly, GPU, networking) each CVE affects, and Microsoft's individual MSRC entries are the only place that detail would sit. The practical consequence for a defender is that this batch cannot be triaged CVE by CVE from the CERT-FR text alone; the version boundary (156.0.4314.42) is the only actionable discriminator in the source. CERT-FR's earlier Edge advisories in the related corpus (CERTFR-2026-AVI-1342 of 19 October 2026, CERTFR-2026-AVI-1267 of 07 October 2026, and the July and August 2026 advisories) show the same pattern: a version boundary, a list of MSRC links, and no exploitation detail. The 19 October advisory did carry an explicit "Exécution de code arbitraire à distance" risk line for versions 155.0.4283.XX before 155.0.4283.60 and before 154.0.4258.37; the current advisory does not carry that line, which is a difference in CERT-FR's risk statement, not evidence that the current batch is less severe. No named threat actor, campaign or malware family is associated with this item in any source, so no attribution is made. ## 4\. Mitigation & containment ### P1 within 24h - Update every managed Edge instance to 156.0.4314.42 or later. The update is delivered through the Microsoft Edge update channel; for managed fleets, confirm the target version in the Edge update policy (Microsoft Edge Update, `UpdateDefault` and `TargetVersionPrefix` under `HKLM\SOFTWARE\Policies\Microsoft\EdgeUpdate`) and verify the installed version from `edge://version` or the `msedge.exe` file version on a sample of endpoints. - Where the estate runs Edge on VDI golden images, rebuild the image with 156.0.4314.42 and redeploy before the next pool refresh; non-persistent pools will otherwise revert to the vulnerable build. - Confirm the update package source is the Microsoft update service and not a third-party mirror, per the NIS2 Art. 21(2)(d) supply chain control above. ### P2 within 72h - Inventory any Edge build pinned below 156.0.4314.42 for application compatibility (kiosk, line-of-business web apps, legacy banking portals) and record the business owner and compensating control for each exception. - Check for side-by-side or unmanaged Edge installs (per-user installs under `%LOCALAPPDATA%\Microsoft\Edge\Application`, portable builds) that the endpoint management tool does not cover; these will not receive the update through the managed channel. - Review browser extension inventory on managed endpoints; extensions are the most common way a browser compromise persists after the CVE is patched, and the source gives no extension-specific detail. ### P3 within 7 days - Add Edge version 156.0.4314.42 to the endpoint compliance baseline and alert on any endpoint reporting a lower version for more than 7 days. - Re-test the firm's browser hardening baseline (extension allowlist, download restrictions, SmartScreen) against the updated build, since a major-version jump can change default behaviour. No vendor workaround is published in the source; the only fix named is the Microsoft Edge security update referenced in the MSRC entries for each CVE. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The CERT-FR advisory and the verified data contain no file hashes, domains, IP addresses, URLs, registry keys, process names or command lines associated with exploitation of these CVEs. No behavioural indicators are described either, so no behavioural indicators table is provided. ## 6\. Detection Insufficient indicators to author detection rules. The source contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file paths, registry keys or hard-coded values that are artefacts of an exploit. The only reliable detection signal available is the Edge version itself, which is a compliance check rather than a detection rule: query endpoint inventory for `msedge.exe` file version below 156.0.4314.42 and treat any match as an unpatched host. ## CVE assessment 10 referenced CVEs — 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ------------ | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-112992](https://nvd.nist.gov/vuln/detail/CVE-2026-112992?ref=f4n6.co.uk) | 9.6 Critical | — | 0% | Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary… | | [CVE-2026-112993](https://nvd.nist.gov/vuln/detail/CVE-2026-112993?ref=f4n6.co.uk) | 8.8 High | — | 0% | Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the… | | [CVE-2026-112994](https://nvd.nist.gov/vuln/detail/CVE-2026-112994?ref=f4n6.co.uk) | 8.8 High | — | 0% | Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside… | | [CVE-2026-112995](https://nvd.nist.gov/vuln/detail/CVE-2026-112995?ref=f4n6.co.uk) | 8.8 High | — | 0% | Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside… | | [CVE-2026-112996](https://nvd.nist.gov/vuln/detail/CVE-2026-112996?ref=f4n6.co.uk) | 8.8 High | — | 0% | Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside… | | [CVE-2026-112997](https://nvd.nist.gov/vuln/detail/CVE-2026-112997?ref=f4n6.co.uk) | 8.8 High | — | 0% | Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary cod… | | [CVE-2026-112998](https://nvd.nist.gov/vuln/detail/CVE-2026-112998?ref=f4n6.co.uk) | 8.8 High | — | 0% | Memory corruption in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside t… | | [CVE-2026-112999](https://nvd.nist.gov/vuln/detail/CVE-2026-112999?ref=f4n6.co.uk) | 8.8 High | — | 0% | Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sa… | | [CVE-2026-113000](https://nvd.nist.gov/vuln/detail/CVE-2026-113000?ref=f4n6.co.uk) | 8.8 High | — | 0% | Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside t… | | [CVE-2026-113001](https://nvd.nist.gov/vuln/detail/CVE-2026-113001?ref=f4n6.co.uk) | 8.8 High | — | 0% | Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside th… | ## 7\. Sources - ANSSI France CERT-FR, "Multiples vulnérabilités dans Microsoft Edge" (CERTFR-2026-AVI-1371), 23 October 2026\. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1371/ - ANSSI France CERT-FR, "Multiples vulnérabilités dans Microsoft Edge" (CERTFR-2026-AVI-1342), 19 October 2026\. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1342/ - ANSSI France CERT-FR, "Multiples vulnérabilités dans Microsoft Edge" (CERTFR-2026-AVI-1267), 07 October 2026\. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1267/ - Microsoft Security Response Center, update guide entries for CVE-2026-112992 through CVE-2026-113344, 22 October 2026\. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112992 ## 8\. Adverse Trace position Adverse Trace assesses this as a high-severity, high-volume browser patch with no confirmed exploitation: the ten CVEs with NVD records are CVSS 9.6 and 8.8, none is in CISA KEV, and all have EPSS 0%, so the urgency comes from the severity of the memory-safety flaws and the size of the exposed estate rather than from observed attacks. The client impact is concentrated in unmanaged and pinned Edge builds, VDI images that revert on refresh, and any estate where the update channel is not centrally controlled; those are the populations that will still be below 156.0.4314.42 a week from now. We will monitor the MSRC entries for CVE-2026-112992 through CVE-2026-113344 for any change in exploitation status or KEV addition, and we will reissue this advisory if Microsoft publishes impact detail that changes the risk classification. Clients should confirm their Edge version baseline against 156.0.4314.42 and report any estate that cannot meet the P1 window. --- [Read the original source →](https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1371/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*