Multiple vulnerabilities in Microsoft Browser

Description

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. Use after free vulnerability in WebGL on Android can be exploited remotely to bypass security restrictions by performing a sandbox escape.
2. Uninitialized use vulnerability in GPU on Android can be exploited remotely to obtain potentially sensitive information from process memory.
3. Use after free vulnerability in WebView on Android can be exploited locally to execute arbitrary code inside a sandbox.
4. Use after free vulnerability in Payments can be exploited by a local attacker with physical access to potentially exploit heap corruption, causing denial of service or executing arbitrary code.
5. Use after free vulnerability in AdFilter can be exploited remotely via a crafted HTML page to execute arbitrary code.
6. A remote code execution vulnerability in IndexedDB can be exploited remotely to execute arbitrary code.
7. A remote code execution vulnerability in Extensions API can be exploited remotely to execute arbitrary code.
8. Denial of service vulnerability in ANGLE can be exploited remotely to cause denial of service.
9. A remote code execution vulnerability in Extensions can be exploited remotely to execute arbitrary code.
10. A remote code execution vulnerability in Views can be exploited remotely to execute arbitrary code.
11. A remote code execution vulnerability in Ozone can be exploited remotely to execute arbitrary code.
12. A remote code execution vulnerability in Autofill can be exploited remotely to execute arbitrary code.
13. A remote code execution vulnerability in Codecs can be exploited remotely to execute arbitrary code.
14. Denial of service vulnerability in WebAppInstalls can be exploited remotely to cause denial of service.
15. A remote code execution vulnerability in Actor can be exploited remotely to execute arbitrary code.
16. A remote code execution vulnerability in Payments can be exploited remotely to execute arbitrary code.
17. A remote code execution vulnerability in Input can be exploited remotely to execute arbitrary code.
18. Denial of service vulnerability in GetUserMedia can be exploited remotely to cause denial of service.
19. A remote code execution vulnerability in Core can be exploited remotely to execute arbitrary code.
20. A remote code execution vulnerability in WebRTC can be exploited remotely to execute arbitrary code.
21. Denial of service vulnerability in Codecs can be exploited remotely to cause denial of service.
22. Denial of service vulnerability in DOM can be exploited remotely to cause denial of service.
23. Security vulnerability in Passwords can be exploited to bypass security restrictions.
24. Denial of service vulnerability in Forms can be exploited remotely to cause denial of service.
25. A remote code execution vulnerability in Forms can be exploited remotely to execute arbitrary code.
26. Denial of service vulnerability in WebGL can be exploited remotely to cause denial of service.
27. Security vulnerability in Navigation can be exploited to bypass security restrictions.
28. Denial of service vulnerability in Navigation can be exploited remotely to cause denial of service.
29. Denial of service vulnerability in V8 can be exploited remotely to cause denial of service.
30. A remote code execution vulnerability in InterestGroups can be exploited remotely to execute arbitrary code.
31. A remote code execution vulnerability in libyuv can be exploited remotely to execute arbitrary code.

Original advisories

• CVE-2026-13282

• CVE-2026-13283
• CVE-2026-15107
• CVE-2026-15108
• CVE-2026-15109
• CVE-2026-15110
• CVE-2026-15111
• CVE-2026-15112
• CVE-2026-15113
• CVE-2026-15114
• CVE-2026-15115
• CVE-2026-15116
• CVE-2026-15117
• CVE-2026-15118
• CVE-2026-15119
• CVE-2026-15120
• CVE-2026-15121
• CVE-2026-15122
• CVE-2026-15123
• CVE-2026-15124
• CVE-2026-15125
• CVE-2026-15126
• CVE-2026-15127
• CVE-2026-15128
• CVE-2026-15129
• CVE-2026-15130
• CVE-2026-15131
• CVE-2026-15132
• CVE-2026-15133
• CVE-2026-15767
• CVE-2026-13028
• CVE-2026-13030
• CVE-2026-13032
• CVE-2026-13037

Exploitation

Public exploits exist for this vulnerability.

Related products

• Microsoft-Edge

CVE list

• CVE-2026-13028
  critical
• CVE-2026-13030
  high
• CVE-2026-13032
  critical
• CVE-2026-13037
  critical
• CVE-2026-13282
  high
• CVE-2026-13283
  critical
• CVE-2026-15107
  critical
• CVE-2026-15108
  warning
• CVE-2026-15109
  high
• CVE-2026-15110
  critical
• CVE-2026-15111
  critical
• CVE-2026-15112
  critical
• CVE-2026-15113
  critical
• CVE-2026-15114
  critical
• CVE-2026-15115
  warning
• CVE-2026-15116
  critical
• CVE-2026-15117
  critical
• CVE-2026-15118
  critical
• CVE-2026-15119
  critical
• CVE-2026-15120
  critical
• CVE-2026-15121
  critical
• CVE-2026-15122
  critical
• CVE-2026-15123
  critical
• CVE-2026-15124
  warning
• CVE-2026-15125
  critical
• CVE-2026-15126
  critical
• CVE-2026-15127
  high
• CVE-2026-15128
  high
• CVE-2026-15129
  critical
• CVE-2026-15130
  warning
• CVE-2026-15131
  warning
• CVE-2026-15132
  critical
• CVE-2026-15133
  critical
• CVE-2026-15767
  critical

KB list

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com