Microsoft November patches cover 1,260 flaws, one Outlook bug exploited
SANS says 68 issues are critical and CVE-2026-124194, an Outlook spoofing bug, is already exploited.
Stories per day · 30 days
2 RSS
Relatedpwn2own4sandbox-escape4uxss4logic-bugs3browser-exploitation1certificate-authority1chromium1code-signing1devcore1emudhra1europol1google-cloud1investment-fraud1ldap1microsoft1ncsc1outlook1patch-management1
9 stories, newest first · one card per story
Stories tagged #microsoft-edge
ThreatsDay covers fraud arrests, slow patching and a $250K cloud bounty
Europol says seven arrests and more than 100 seized servers followed fraud losses of at least $4.5 million.
1
Five-bug chain escapes Edge sandbox without memory corruption, earns $175,000 at Pwn2Own
Orange Tsai combined logical flaws in Edge and Windows features to gain code execution from an ordinary web page with no clicks; patch status is unconfirmed.
1
Edge exploit chain uses five logic bugs to escape the sandbox
Orange Tsai’s Pwn2Own Berlin chain turns a malicious page into Windows code via UXSS and a writable protocol config, without memory corruption.
2
Logic bugs alone escaped Microsoft Edge at a $175,000 Pwn2Own win
DEVCORE's chain needs no memory corruption and was fixed in Edge 148.0.3967.70 the day after the May contest.
2
Orange Tsai details logic-only Microsoft Edge full chain from Pwn2Own
DEVCORE used five logic bugs and two Windows features for an Edge sandbox escape, earning $175,000 and a Pwnie award.
2
Microsoft emergency updates block compromised eMudhra certificates
Eight recoverable intermediate keys could forge TLS or code-signing certificates; Microsoft says its own systems were not affected.
One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude
Researchers showed a single browser extension could hijack AI agents in Chrome, Edge, Comet, Opera Neon and Claude in Chrome, earning $20,000 in bounties.
3
Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits
Proofpoint reports the BlueMoon exploit kit, chaining two Chrome V8 zero-days and a Windows ALPC bug, being shared across China-linked espionage groups.