Microsoft Edge 149.0.4022.80
Microsoft Edge 149.0.4022.80, released June 18, 2026, fixes 23 CVEs in Microsoft Edge. None of them is reported as exploited. Patch Radar priority: Urgent. The latest Microsoft Edge is 156.0.4314.58, which also fixes every one of these CVEs.
Superseded. The latest Microsoft Edge is 156.0.4314.58, which also fixes every CVE on this page. Install that instead.
Priority of the 23 CVEs
Applies to
| Product | Version |
|---|---|
| Microsoft Edge | 149.0.4022.80 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2026-12440 | Chromium: CVE-2026-12440 Use after free in DigitalCredentials | 9.6 | 0.0025 | None reported |
| High | CVE-2026-12443 | Chromium: CVE-2026-12443 Use after free in Web Authentication | 8.8 | 0.0061 | None reported |
| High | CVE-2026-12447 | Chromium: CVE-2026-12447 Heap buffer overflow in WebRTC | 8.8 | 0.0043 | None reported |
| High | CVE-2026-12466 | Chromium: CVE-2026-12466 Heap buffer overflow in WebRTC | 8.8 | 0.0043 | None reported |
| High | CVE-2026-12439 | Chromium: CVE-2026-12439 Use after free in Digital Credentials | 8.8 | 0.0033 | None reported |
| High | CVE-2026-12437 | Chromium: CVE-2026-12437 Use after free in WebShare | 8.3 | 0.0030 | None reported |
| High | CVE-2026-12462 | Chromium: CVE-2026-12462 Use after free in Media | 7.5 | 0.0027 | None reported |
| High | CVE-2026-12465 | Chromium: CVE-2026-12465 Insufficient validation of untrusted input in Metrics | 8.3 | 0.0024 | None reported |
| High | CVE-2026-12455 | Chromium: CVE-2026-12455 Use after free in Tab Strip | 7.5 | 0.0023 | None reported |
| High | CVE-2026-12464 | Chromium: CVE-2026-12464 Use after free in Browser | 8.3 | 0.0022 | None reported |
| High | CVE-2026-12467 | Chromium: CVE-2026-12467 Use after free in Extensions | 8.3 | 0.0022 | None reported |
| High | CVE-2026-12451 | Chromium: CVE-2026-12451 Use after free in DigitalCredentials | 8.3 | 0.0018 | None reported |
| High | CVE-2026-12445 | Chromium: CVE-2026-12445 Use after free in Extensions | 7.5 | 0.0016 | None reported |
| High | CVE-2026-12449 | Chromium: CVE-2026-12449 Use after free in Chromoting | 7.8 | 0.0011 | None reported |
| Routine | CVE-2026-12461 | Chromium: CVE-2026-12461 Out of bounds read in WebRTC | 6.5 | 0.0024 | None reported |
| Routine | CVE-2026-12446 | Chromium: CVE-2026-12446 Insufficient data validation in Passwords | 4.3 | 0.0019 | None reported |
| Routine | CVE-2026-12458 | Chromium: CVE-2026-12458 Incorrect security UI in Passwords | 3.1 | 0.0019 | None reported |
| Routine | CVE-2026-12459 | Chromium: CVE-2026-12459 Inappropriate implementation in Serial | 6.1 | 0.0018 | None reported |
| Routine | CVE-2026-12453 | Chromium: CVE-2026-12453 Insufficient validation of untrusted input in Input | 4.2 | 0.0018 | None reported |
| Routine | CVE-2026-12460 | Chromium: CVE-2026-12460 Insufficient policy enforcement in File System Access | 4.2 | 0.0015 | None reported |
| Routine | CVE-2026-12444 | Chromium: CVE-2026-12444 Out of bounds read in Chromoting | 5.5 | 0.0014 | None reported |
| Routine | CVE-2026-12456 | Chromium: CVE-2026-12456 Insufficient validation of untrusted input in Extensions | 4.2 | 0.0014 | None reported |
| Routine | CVE-2026-12457 | Chromium: CVE-2026-12457 Insufficient data validation in Extensions | 4.2 | 0.0014 | None reported |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.