MicrosoftAnalysisMicrosoft resolves out-of-bounds memory read flaw in Edge Chromium
What happened.Microsoft released security updates for Microsoft Edge addressing an out-of-bounds memory read vulnerability in the Chromium browser engine.
Why it matters.Enterprise web browsers process untrusted public web scripts alongside sensitive corporate SaaS sessions. When out-of-bounds memory read flaws disclose heap memory, threat actors extract session cookies, cryptographic keys, and internal memory layouts. IT administrators should verify that Microsoft Edge clients receive the 142.0.3595.65 update. Security teams should enforce strict process isolation policies across enterprise browsing environments.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-122518 with a CVSS score of 6.5, the flaw occurs during memory buffer indexing in core browser processing routines.
- Information exposure: Remote attackers hosting malicious web content can cause the browser process to read adjacent memory blocks, leaking sensitive heap data.
- Exploit chaining: Attackers commonly chain memory disclosure defects with separate write primitives to bypass address space layout randomization defenses.
- Affected versions: The vulnerability impacts Microsoft Edge Stable channel builds prior to release 142.0.3595.65 on Windows, macOS, and Linux.
- Patch deployment: Microsoft published Edge version 142.0.3595.65, delivering automated client updates through background browser servicing tasks.