# Microsoft Edge 148 patch addresses 150 vulnerabilities

Published: 2026-06-02 · Severity: routine
Canonical: https://vorant.io/reports/1095019e-1159-5e90-a593-75c91645bb13/microsoft-edge-148-patch-addresses-150-vulnerabilities

> Microsoft Edge versions before 148.0.3967.96/97 contain 150 unspecified vulnerabilities requiring immediate patching.

CERT-FR issued a security advisory documenting 150 distinct vulnerabilities affecting Microsoft Edge prior to version 148.0.3967.96 (and 148.0.3967.97 for certain fixes). The advisory does not specify the individual impact or attack vectors for each vulnerability, stating only that they allow attackers to cause unspecified security issues. Microsoft released patches on May 29 and May 31, 2026 as part of its standard release cycle. Organizations running affected versions must update immediately to the patched release. The large number of vulnerabilities in a single release cycle reflects typical Chromium-based browser patching where numerous issues—ranging from memory safety flaws to logic errors—are bundled together. Defenders should prioritize deployment of this update across all Edge installations, particularly in environments where Edge is used for web access or as a platform for enterprise web applications.

## Mentioned in this report

- Vulnerabilities: CVE-2026-10000, CVE-2026-10001, CVE-2026-10002, CVE-2026-10003, CVE-2026-10004, CVE-2026-10005, CVE-2026-10006, CVE-2026-10007, CVE-2026-10009, CVE-2026-10011, CVE-2026-10012, CVE-2026-10013, CVE-2026-10015, CVE-2026-10016, CVE-2026-10017, CVE-2026-10018, CVE-2026-10019, CVE-2026-10021, CVE-2026-10022, CVE-2026-9873, CVE-2026-9874, CVE-2026-9877, CVE-2026-9878, CVE-2026-9879, CVE-2026-9881, CVE-2026-9883, CVE-2026-9884, CVE-2026-9885, CVE-2026-9886, CVE-2026-9890, CVE-2026-9893, CVE-2026-9894, CVE-2026-9895, CVE-2026-9897, CVE-2026-9899, CVE-2026-9900, CVE-2026-9901, CVE-2026-9903, CVE-2026-9904, CVE-2026-9905

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0680

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1095019e-1159-5e90-a593-75c91645bb13/microsoft-edge-148-patch-addresses-150-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup