Microsoft has shipped a new Edge build that closes twelve security holes inherited from Chromium, and the most serious of them can be reached by nothing more than a web page you visit. The version to be on is Edge 151.0.4129.101, released on August 20.
Microsoft listed the fixes in its Edge security release notes, and Hong Kong's HKCERT flagged the update to its constituents on August 24. Nine of the twelve carry a base score of 8.3 or higher.
Getting outside the sandbox is the whole game
The sandbox is the wall Chromium puts between a web page and the rest of your machine. Code that runs inside it can ruin the tab and not much else. Code that gets outside it runs as you, with your files, your saved sessions and your network. The published descriptions say plainly which side of that wall each bug lands on, and that is what separates the twelve into serious and routine.
Six of the fixes involve code or memory access outside the sandbox. Four are confined to the renderer, including type confusion in the V8 JavaScript engine (CVE-2026-76038, CVE-2026-76043 and CVE-2026-76047) and a use-after-free in WebGL (CVE-2026-76045), all scored 8.8. The remaining two are lesser bypasses: an information leak in the Skia graphics library (CVE-2026-76041) and a site-isolation bypass in CORS (CVE-2026-76033).
Only two of them need nothing but a visit
Strip out the entries with preconditions attached and two are left where the vendor description asks for nothing beyond a crafted page. CVE-2026-76035 is a flaw in Chromium's Media component, scored 9.6, that lets a remote attacker execute code outside the sandbox; the National Vulnerability Database records it as affecting Mac builds. CVE-2026-76034 is a buffer overflow in WebGL with the same outcome and no platform limitation stated.
The others come with strings. CVE-2026-76040 requires the user to be walked into something through social engineering. CVE-2026-76037 requires a local program already running on a Windows machine. CVE-2026-76044, a race condition in USB handling, and CVE-2026-76042, an uninitialized GPU resource, both assume the attacker has already compromised the renderer process, which means they are second-stage bugs rather than a way in.
The two severity ratings disagree with each other
These fixes carry two independent gradings and they do not line up. NVD scores CVE-2026-76035 at 9.6 and calls it critical, while Chromium's own severity rating for the same bug is High. The order reverses on CVE-2026-76034, which NVD scores 8.8 but which Google's security team rates Critical, its top tier. The two scales measure different things, so neither is wrong, but a team triaging on the NVD column alone would put the WebGL overflow second when the people who fixed it put it first. On this release it is worth reading both.
Update to 151.0.4129.101 and then restart
Edge updates itself, but the restart is what actually applies the new binary, so a browser left open across a long week is still running the old one. Check under Settings, then About Microsoft Edge, and confirm the build reads 151.0.4129.101 or later. Managed fleets can take it through the usual update channels. There is no workaround short of installing it.
Neither Microsoft's release notes nor the HKCERT bulletin reports any of the twelve being exploited, and none of them appear in CISA's Known Exploited Vulnerabilities catalog as of its August 21 edition. Microsoft's previous Edge round, six flaws in the same 151 line, shipped a week earlier, and Google patched an unrelated critical flaw in Chrome's remote desktop feature on August 21. Nothing here calls for an overnight change window. It is a good reason not to leave a browser running untouched for a fortnight.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.