CERT-FR flags multiple Microsoft Edge vulnerabilities
CERT-FR advisory lists numerous Microsoft Edge vulnerabilities allowing privilege escalation and other unspecified security issues; update to 153.0.4234.46 or later.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR published an advisory summarizing multiple vulnerabilities discovered in Microsoft Edge affecting all versions prior to 153.0.4234.46. According to the advisory, successful exploitation could allow an attacker to achieve privilege escalation, as well as an additional security issue not further specified by the vendor. No technical details, exploitation vectors, or proof-of-concept information are included in the bulletin.
The advisory references over 40 distinct CVE identifiers (CVE-2026-91708 through CVE-2026-91749, plus CVE-2026-88097), all tied to the same Microsoft Edge security bulletin dated 17-18 September 2026. There is no indication in the advisory of active exploitation in the wild. CERT-FR's guidance is straightforward: consult Microsoft's official security bulletins for each CVE and apply the vendor-supplied patches to update Edge to version 153.0.4234.46 or later.
For defenders, the practical action is to ensure Microsoft Edge is updated across the estate via standard patch management or Windows/Edge auto-update mechanisms. Given the volume of CVEs bundled into a single monthly-style release and the lack of reported in-the-wild exploitation, this should be treated as a routine but broad patch requirement rather than an emergency response.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1208
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs