Microsoft released Edge Stable 153.0.4234.48 on September 18, 2026, with the latest Chromium security updates.[1] Microsoft also published CVE-2026-88097, an Important Edge elevation-of-privilege vulnerability that can allow a browser sandbox escape under specific conditions; MSRC says customer action is required, but it did not mark the flaw publicly disclosed or exploited at our cutoff.[2]
Update status at a glance
Security release Target version: Microsoft Edge Stable 153.0.4234.48 or later.[1] This is a browser security update—not a new Windows cumulative KB, Patch Tuesday release, out-of-band Windows OS update, preview update, or Insider build.[1][4]
Reporting cutoff: September 18, 2026 at 7:13 p.m. EDT (23:13 UTC).
What Microsoft says changed
Microsoft’s Edge security-release page lists Stable version 153.0.4234.48 on September 18 and says it incorporates the latest Chromium security updates. The same page lists 153.0.4234.46 one day earlier.[1] MSRC’s record for CVE-2026-88097 maps its vendor fix to 153.0.4234.46, so the practical target is the newer Stable build 153.0.4234.48 or later—not the older minimum fixed build.[1][2]
MSRC describes CVE-2026-88097 as a use-after-free issue in Microsoft Edge (Chromium-based). A successful attacker could elevate from Low Integrity inside a contained browser sandbox to Medium Integrity, which Microsoft characterizes as a browser sandbox escape.[2] Microsoft says exploitation requires knowledge of a specific operation that triggers a memory-allocation failure, and rates exploitation of the latest software release as “less likely.”[2] “Less likely” is not the same as impossible, and “not exploited” is a point-in-time vendor status—not a guarantee about future activity.
Good points
Cautions
- The flaw can cross the browser sandbox boundary from Low to Medium Integrity when successfully exploited.[2]
- An update may be downloaded but not fully active until every Edge window is closed and the browser is relaunched.[3]
- Managed devices can remain behind because of staged rollouts, policy deferrals, offline systems, or users who keep browser sessions open.
Who is affected—and who is not
| Situation | Reading | Action |
|---|---|---|
| Edge Stable below 153.0.4234.48 | Update recommended | Open edge://settings/help, let the update complete, relaunch Edge, and verify the full four-part version.[1][3] |
| Edge Stable 153.0.4234.48 or later | Current for this release | Confirm the relaunch completed; continue normal automatic updates.[1] |
| Managed Windows or Mac fleet | Deployment-dependent | Measure actual browser versions and restart compliance; do not infer Edge status from the Windows build or macOS version. |
| Safari-only Mac user | Not affected by this Edge-specific flaw | Continue normal Apple updating. Apple’s public security table showed no September 18 macOS security release at the cutoff.[5] |
| Windows itself | No same-day Windows OS package | Keep Windows current, but do not confuse this separate Edge release with a Windows cumulative update.[4] |
What home users should do
- Save browser work. Finish important forms and save documents open in web apps.
- Check Edge directly. Choose Settings and more → Help and feedback → About Microsoft Edge, or enter
edge://settings/help.[3] - Let the browser update. The practical target is 153.0.4234.48 or later.[1]
- Relaunch and verify. Return to the About page and confirm the full version. If Edge says it is managed, follow the organization’s process instead of bypassing policy.
- Ignore update pop-ups from random websites. Use Edge’s built-in updater or Microsoft’s official download path.
What businesses should do
- Inventory the full version. “Edge 153” is not precise enough; report all four version fields.
- Separate download from restart compliance. Look for active older browser processes after the package arrives.
- Pilot important web workflows. Test Microsoft 365, authentication, line-of-business sites, browser extensions, printing, downloads, kiosks, and WebView2-dependent applications.
- Use normal deployment controls. Keep rollout rings and rollback plans; do not disable sandbox or browser protections to work around compatibility issues.
- Own exceptions. Give every deferred or incompatible endpoint an owner, reason, and follow-up date.
- Check both Windows and Mac fleets. Edge’s browser version is independent of the operating-system version.
What remains unknown
Microsoft’s September 18 Edge note says additional CVEs will be added when available.[1] That means today’s public list may grow. This article does not claim CVE-2026-88097 is the only issue addressed by 153.0.4234.48, and it does not claim active exploitation where Microsoft reports none.
Windows and Apple check for September 18
Microsoft’s same-day production activity was the Edge Stable browser security release. The latest production Windows cumulative packages remained the September 14 out-of-band updates covered in our September 14 Windows and macOS update guide.[4]
Apple’s security-release table had no September 18 macOS security entry at the cutoff; its newest Mac-related releases remained dated September 14.[5] Apple’s developer feed listed Xcode 27.1 beta on September 18, which is developer prerelease activity—not a public macOS security update.[6] Apple’s Background Security Improvements page still listed its latest dated component release as March 17, 2026.[7]
Frequently asked questions
Is this Patch Tuesday?
No. This is an Edge Stable browser security release on Edge’s own cadence, not a Windows cumulative KB.[1]
Is CVE-2026-88097 being exploited?
Microsoft marked it not exploited and not publicly disclosed at our cutoff, with exploitation of the latest software release assessed as less likely.[2] Those are point-in-time assessments, not permanent guarantees.
Why target .48 if MSRC lists .46?
MSRC maps the vendor fix to 153.0.4234.46, released September 17, while Microsoft’s live Edge security notes list newer Stable build 153.0.4234.48 on September 18.[1][2] Installing the newest available Stable build avoids stopping at an older minimum fixed build.
Does this affect Edge on Mac?
Microsoft’s CVRF record names Microsoft Edge (Chromium-based), and Edge updates independently of macOS.[2] Mac users who run Edge should check Edge’s own version; Safari-only users are not affected by an Edge-specific vulnerability.[2][5]
Should I uninstall Edge?
Microsoft provides a fixed Stable build, so the practical response is to update and relaunch the browser. Uninstalling a managed or integrated browser can create other support problems and is not Microsoft’s documented remediation.
Official sources
- Microsoft: Release notes for Microsoft Edge Security Updates — September 18 Stable release and version 153.0.4234.48.
- Microsoft Security Response Center: CVE-2026-88097 and the September 2026 CVRF — severity, exploit status, sandbox-escape description, action requirement, and fixed build.
- Microsoft Support: Microsoft Edge update settings — automatic updating, restart behavior, and version check.
- Microsoft Windows Message Center — same-day Windows production-advisory check and classification.
- Apple security releases — same-day macOS security-release check.
- Apple Developer software releases — September 18 developer-beta classification.
- Apple Background Security Improvements by date — latest dated background component release.
Original hero illustration by The IT Guys. It represents a browser security fix and sandbox protection; it is not a screenshot of a real warning, attack, or operating-system update.