# CERT-FR flags dozens of Edge CVEs

Published: 2026-11-02 · Severity: routine
Canonical: https://vorant.io/reports/c3528386-ee71-5eed-8bc2-7f2b7bf6f2fd/cert-fr-flags-dozens-of-edge-cves
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advisory lists over 50 unspecified vulnerabilities in Microsoft Edge versions before 153.0.4234.46 and 156.0.4314.56, urging patching.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1440

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR has published an advisory covering more than 50 vulnerabilities affecting Microsoft Edge versions prior to 153.0.4234.46 and 156.0.4314.56. The advisory references individual Microsoft Security Response Center (MSRC) bulletins for each CVE, dated 31 October 2026, but does not detail the technical nature, exploitability, or impact of each flaw — the risk level is marked as unspecified by the vendor in the original French-language bulletin.

As a standard CERT-FR vulnerability roundup, the advisory aggregates Microsoft's own disclosures rather than providing independent analysis. Defenders should consult the linked MSRC bulletins for per-CVE severity, CVSS scores, and exploitability assessments, and apply the vendor-supplied updates to bring Edge to the fixed versions. No in-the-wild exploitation is mentioned in this advisory.

Given the volume of CVEs bundled into a single release and the lack of detail on exploitability or active exploitation, this should be treated as routine browser patch management rather than an urgent incident-response matter, though organizations should prioritize patching given Edge's widespread deployment.

## Mentioned in this report

- Vulnerabilities: CVE-2026-118304, CVE-2026-118305, CVE-2026-118306, CVE-2026-118307, CVE-2026-118308, CVE-2026-118310, CVE-2026-118311, CVE-2026-118312, CVE-2026-118313, CVE-2026-118315, CVE-2026-118316, CVE-2026-118317, CVE-2026-118318, CVE-2026-118319, CVE-2026-118320, CVE-2026-118322, CVE-2026-118327, CVE-2026-118328, CVE-2026-118329, CVE-2026-118330, CVE-2026-118331, CVE-2026-118332, CVE-2026-118333, CVE-2026-118334, CVE-2026-118335, CVE-2026-118336, CVE-2026-118337, CVE-2026-118338, CVE-2026-118339, CVE-2026-118340, CVE-2026-118341, CVE-2026-118342, CVE-2026-118343, CVE-2026-118344, CVE-2026-118345, CVE-2026-118346, CVE-2026-118347, CVE-2026-118348, CVE-2026-118349, CVE-2026-118350

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1440

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c3528386-ee71-5eed-8bc2-7f2b7bf6f2fd/cert-fr-flags-dozens-of-edge-cves.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup