Microsoft Edge Stable addresses CVE-2026-118304 via Chromium fix

Microsoft Edge Stable version 156.0.4314.58, released Oct. 30, 2026, takes in the latest Chromium security updates. Edge consumes the Chromium fix for CVE-2026-118304, an improper input validation flaw in SVG handling.

Chrome assigned CVE-2026-118304, and Microsoft added it to its security update guidance. Microsoft tells readers to check Google Chrome Releases for information on CVE-2026-118304. PremierePC says Microsoft MSRC supplies the source feed for its CVE-2026-118304 alert page, and the alert page shows Microsoft MSRC on the source-feed line for this CVE, linking it to Microsoft’s security response center feed. EPSS, a probability score, puts the probability for CVE-2026-118304 at 0.27%.

Edge Stable release notes say every release pulls in the newest Chromium security updates, and Chromium is the browser project whose code Edge consumes. Version 156.0.4314.56 shipped Oct. 29, 2026, and version 156.0.4314.58 shipped Oct. 30, 2026, and Microsoft says CVE numbers will arrive as soon as they are ready for both builds. Those two October Stable builds show a placeholder note since CVE identifiers were not attached when published.

Version 156.0.4314.42 shipped Oct. 22, 2026, version 155.0.4283.62 shipped Oct. 16, 2026, and version 155.0.4283.60 shipped Oct. 15, 2026, and each build takes in the latest Security Updates from the Chromium project. Microsoft’s documentation uses this wording across many dated build entries, describing Edge as a recipient of Chromium security updates, not the origin of separate patches.

Microsoft’s Security Update Guide lists 414 CVE entries for Edge from Sept. 9 to Oct. 12, 2026. Of the total, 409 came from Chromium republication and five covered Edge alone. None of the Edge CVEs published in that window carried an exploited flag, and no Edge release in the period saw an exploit reported as actively used. The October Patch Tuesday release contained no browser CVEs for a third straight month, and Edge security updates went out between Patch Tuesday cycles instead of inside the October cumulative release.

Microsoft’s own products accounted for 111 Security Update Guide entries from Sept. 9 to Oct. 12, 2026, and Chromium republications for Edge were left out as the count ran from the September Patch Tuesday to the October Patch Tuesday with Edge Chromium republications tracked apart. Microsoft described 90 of those 111 entries as true revisions rather than new entries, and the source describes most entries in that September-to-October window as revisions instead of brand-new CVE records; the September update-guide window held just one true revision.