---
id: "CVE-2026-96199"
kind: "vulnerability"
aliases: ["CVE-2026-96199"]
title: "Microsoft Edge: heap buffer overflow lets a remote attacker run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Microsoft Edge (Chromium-based)", "fixed": ["155.0.4283.62"], "affected": "< 155.0.4283.62", "ecosystem": "vendor"}]
ecosystems: []
tags: ["browser", "chromium", "microsoft-edge", "other", "windows"]
not_affected_if: ["fully-updated-edge"]
published_at: "2026-10-29T16:20:08+00:00"
first_seen_at: "2026-10-29T16:26:04+00:00"
updated_at: "2026-10-29T16:33:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96199", "first_seen_at": "2026-10-29T16:26:04+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T16:33:41+00:00"}]
---

# Microsoft Edge: heap buffer overflow lets a remote attacker run code

Heap buffer overflow (CWE-122) in Chromium-based Microsoft Edge. A malicious web page can run code once the user visits it (CVSS 8.8, user interaction required). Fixed in the Oct 16 2026 Stable release per Tenable; no known exploitation or public PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Edge (Chromium-based) affected < 155.0.4283.62 fixed 155.0.4283.62

## How to check

Open edge://settings/help. Edge updates itself and shows the version. If it is below 155.0.4283.62, update and restart the browser.

## Fix

Update Microsoft Edge (Stable, desktop) to 155.0.4283.62 or later; 156.0.4314.42 is current as of Oct 22. Unconfirmed against the MSRC page.

## Timeline

- 2026-10-29T16:26:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96199
- 2026-10-29T16:33:41+00:00 analyst — MSRC page is JS-only and returned no content, so nothing verified. Tenable (via Vulners) lists Edge < 155.0.4283.62 as affected, and the Edge release notes show 155.0.4283.62 shipped Oct 16 2026, the CVE publish date. 156.0.4314.42 (Oct 22) is newer. Not confirmed on the vendor page that this CVE is in 155.0.4283.62. Feedly says user interaction required (CVSS UI:R), no known exploitation, no public PoC. Edge for Android has its own build (155.0.4283.61).

## Documents

- [fix] Microsoft Edge security release notes https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security
- [mentions] Vulners mirror of MSRC CVE-2026-96199 (lists Tenable Edge < 155.0.4283.62) https://vulners.com/mscve/MS:CVE-2026-96199

## From the sources

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_