Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

Microsoft Edge (Chromium) < 147.0.3912.60 Multiple Vulnerabilities

🗓️ 10 Apr 2026 00:00:00Reported by TenableType 
nessus
 nessus🔗 www.tenable.com👁 20 Views

Edge for Windows before 147.0.3912.60 has spoofing, UI misrepresentation, and WebML heap/overflow.

Related
Refs
Code
ReporterTitlePublishedViews
Family
OSV		MINI-GVG8-JG37-H9QC
28 Apr 202603:19
–osv
OSV		MINI-GX6P-M549-6P6F
28 Apr 202603:20
–osv
OSV		MINI-H2WH-X38C-JF9R
28 Apr 202603:19
–osv
OSV		MINI-H3WX-H85X-M8G4
28 Apr 202603:17
–osv
OSV		MINI-HH6P-JH7H-GJV3
28 Apr 202603:19
–osv
OSV		MINI-J3R3-3WCF-8HPX
28 Apr 202603:18
–osv
OSV		MINI-J8H7-QG9J-3WWM
28 Apr 202603:18
–osv
OSV		MINI-J9VC-JXRR-4M7R
28 Apr 202603:19
–osv
OSV		MINI-JM39-4P79-4RRG
28 Apr 202603:18
–osv
OSV		MINI-JX3R-Q2GR-3G3Q
28 Apr 202603:19
–osv
Rows per page
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(305979);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/19");

  script_cve_id(
    "CVE-2026-5858",
    "CVE-2026-5859",
    "CVE-2026-5860",
    "CVE-2026-5861",
    "CVE-2026-5862",
    "CVE-2026-5863",
    "CVE-2026-5864",
    "CVE-2026-5865",
    "CVE-2026-5866",
    "CVE-2026-5867",
    "CVE-2026-5868",
    "CVE-2026-5869",
    "CVE-2026-5870",
    "CVE-2026-5871",
    "CVE-2026-5872",
    "CVE-2026-5873",
    "CVE-2026-5874",
    "CVE-2026-5875",
    "CVE-2026-5876",
    "CVE-2026-5877",
    "CVE-2026-5878",
    "CVE-2026-5879",
    "CVE-2026-5880",
    "CVE-2026-5881",
    "CVE-2026-5882",
    "CVE-2026-5883",
    "CVE-2026-5884",
    "CVE-2026-5885",
    "CVE-2026-5886",
    "CVE-2026-5887",
    "CVE-2026-5888",
    "CVE-2026-5889",
    "CVE-2026-5890",
    "CVE-2026-5891",
    "CVE-2026-5892",
    "CVE-2026-5893",
    "CVE-2026-5894",
    "CVE-2026-5895",
    "CVE-2026-5896",
    "CVE-2026-5897",
    "CVE-2026-5898",
    "CVE-2026-5899",
    "CVE-2026-5900",
    "CVE-2026-5901",
    "CVE-2026-5902",
    "CVE-2026-5903",
    "CVE-2026-5904",
    "CVE-2026-5905",
    "CVE-2026-5906",
    "CVE-2026-5907",
    "CVE-2026-5908",
    "CVE-2026-5909",
    "CVE-2026-5910",
    "CVE-2026-5911",
    "CVE-2026-5912",
    "CVE-2026-5913",
    "CVE-2026-5914",
    "CVE-2026-5915",
    "CVE-2026-5918",
    "CVE-2026-5919",
    "CVE-2026-33118",
    "CVE-2026-33119"
  );
  script_xref(name:"IAVA", value:"2026-A-0326");

  script_name(english:"Microsoft Edge (Chromium) < 147.0.3912.60 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an web browser installed that is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Microsoft Edge installed on the remote Windows host is prior to 147.0.3912.60. It is, therefore, affected
by multiple vulnerabilities as referenced in the April 10, 2026 advisory.

  - Use after free in PrivateAI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who
    convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted
    HTML page. (Chromium security severity: Medium) (CVE-2026-5874)

  - User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an
    unauthorized attacker to perform spoofing over a network. (CVE-2026-33119)

  - Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVE-2026-33118)

  - Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute
    arbitrary code via a crafted HTML page. (Chromium security severity: Critical) (CVE-2026-5858)

  - Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially
    exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) (CVE-2026-5859)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#april-10-2026
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f63c1a49");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33118");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33119");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5858");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5859");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5860");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5861");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5862");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5863");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5864");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5865");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5866");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5867");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5868");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5869");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5870");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5871");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5872");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5873");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5874");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5875");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5876");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5877");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5878");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5879");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5880");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5881");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5882");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5883");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5884");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5885");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5886");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5887");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5888");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5889");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5890");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5891");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5892");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5893");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5894");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5895");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5896");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5897");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5898");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5899");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5900");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5901");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5902");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5903");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5904");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5905");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5906");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5907");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5908");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5909");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5910");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5911");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5912");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5913");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5914");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5915");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5918");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5919");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Microsoft Edge version 147.0.3912.60 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-5883");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:edge");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("microsoft_edge_chromium_installed.nbin", "smb_hotfixes.nasl");
  script_require_keys("installed_sw/Microsoft Edge (Chromium)", "SMB/Registry/Enumerated");

  exit(0);
}

include('vcf.inc');
include('smb_hotfixes.inc');

get_kb_item_or_exit('SMB/Registry/Enumerated');

if (hotfix_check_sp_range(win10:'0') <= 0)
  audit(AUDIT_OS_SP_NOT_VULN);

var app_info = vcf::get_app_info(app:'Microsoft Edge (Chromium)', win_local:TRUE);

var extended = FALSE;
if (app_info['Channel'] == 'extended') extended = TRUE;

var constraints;
if (!extended) {
	constraints = [
  		{ 'fixed_version' : '147.0.3912.60' }
	];
} else {
	audit(AUDIT_INST_VER_NOT_VULN, 'Microsoft Edge (Chromium)');
};
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
19 May 2026 00:00Current
7.7High risk
Vulners AI Score7.7
CVSS 3.18.8 - 9.8
EPSS0.00608
SSVC
edge chromiumspoofing vulnerabilityui misrepresentationwebml heap overflowwebml integer overflowwindows vulnerabilityversion 147.0.3912.60
20