Microsoft has published security documentation for Microsoft Edge Stable 152.0.4191.53, a browser update released August 27 with a large set of newly published Edge and Chromium vulnerability records.[1] Microsoft’s live security notes list seven Edge-specific CVEs, while the August MSRC data carrying an August 28 initial-revision timestamp contains 304 new Edge/Chromium CVE records: 295 Chromium records and nine Microsoft Edge-branded records.[1][2]
Update status at a glance
Security release Target version: Microsoft Edge Stable 152.0.4191.53.[1] The browser update is dated August 27; Microsoft’s detailed CVE publication is dated August 28.[1][2] This is not a new Windows cumulative KB, Patch Tuesday release, out-of-band Windows OS patch, preview update, or Insider build.[1][4]
Reporting cutoff: August 28, 2026 at 7:15 p.m. EDT (23:15 UTC).
Why this deserves attention
Edge is updated on its own browser cadence, so a Windows PC can have the latest August cumulative update and still be waiting for an Edge restart. Microsoft says Edge normally updates automatically when the browser restarts; the About page at edge://settings/help can check the installed version and download an available update.[3]
The number 304 needs careful interpretation. It is the count of new Edge/Chromium CVE records in Microsoft’s August CVRF document carrying an initial revision timestamp of August 28—not a claim that one PC had 304 independently exploitable flaws, that every flaw affects every Edge configuration, or that Microsoft marked 304 attacks as active.[2] Applicability depends on the browser build, platform, enabled features, and the upstream Chromium components included in the release.[2]
Good points
- Edge normally updates automatically and the installed version is easy to verify.[3]
- MSRC did not mark any of the nine new Microsoft Edge-branded records as publicly disclosed or exploited in the fields available at the cutoff.[2]
- Microsoft provides a fixed build, 152.0.4191.53, for the documented desktop Edge vulnerabilities.[1][2]
Cautions
- Four Edge-branded records are titled remote-code-execution vulnerabilities.[2]
- The upstream Chromium records do not carry Microsoft exploit-status fields in the CVRF data, so “not exploited” cannot be generalized to all 304 records.[2]
- A downloaded update may not fully take effect until every Edge window is closed and the browser is relaunched.[3]
The Edge-specific vulnerabilities Microsoft highlighted
Microsoft’s Edge security-release page lists seven Edge-specific CVEs for version 152.0.4191.53.[1] The live MSRC feed also published two additional Edge-branded records the same morning—CVE-2026-70309 and CVE-2026-70331, whose title names Edge for iOS—which are not in that seven-item release-note list at the cutoff.[2]
| CVE | MSRC title / impact | MSRC severity or state | Practical reading |
|---|---|---|---|
| CVE-2026-58616 | Copilot Chat information disclosure | Moderate; not publicly disclosed or exploited[2] | Update Edge; do not infer that every Copilot conversation was exposed. |
| CVE-2026-62904 | Edge information disclosure | Moderate; not publicly disclosed or exploited[2] | Keep the browser current and avoid unsupported workarounds. |
| CVE-2026-66323 | Remote code execution | Important; not publicly disclosed or exploited[2] | RCE describes possible impact, not proof of active exploitation. |
| CVE-2026-66324 | Spoofing | Important; not publicly disclosed or exploited[2] | Continue to verify suspicious pages and prompts even after updating. |
| CVE-2026-66798 | Remote code execution | Important; not publicly disclosed or exploited[2] | Prioritize browser restarts on shared and business devices. |
| CVE-2026-70341 | Remote code execution | MSRC exploit status says not public/not exploited; the record’s product-remediation fields were incomplete in the downloaded CVRF snapshot[2] | Treat the Edge release-note association as authoritative, but do not invent missing technical details. |
| CVE-2026-72984 | Remote code execution | Important; not publicly disclosed or exploited; Microsoft rates exploitation “more likely”[2] | “More likely” is an exploitability assessment, not evidence of attacks in the wild. |
| CVE-2026-70309 | Security-feature bypass | Moderate; not publicly disclosed or exploited[2] | Same-day Edge record in MSRC, but not in the seven-item Edge release-note list at cutoff. |
| CVE-2026-70331 | Microsoft Edge for iOS spoofing | Moderate; not publicly disclosed or exploited[2] | Although the title names Edge for iOS, the CVRF maps affected status and fixed build 150.0.4078.50 to both Microsoft Edge (Chromium-based) and Microsoft Edge for iOS; do not describe it as iOS-only. |
What remains unknown
Microsoft’s CVRF feed provides exploit-status fields for the Microsoft Edge-branded records, but the 295 republished Chromium records in this batch do not include equivalent Microsoft exploit-status fields.[2] We therefore cannot responsibly say that the entire Chromium set is unexploited. Microsoft’s Edge page says version 152.0.4191.53 incorporates the latest Chromium security updates; it does not provide a one-line affected/not-affected map for every upstream record.[1][2]
Who is affected—and who is not
| Situation | Status | Action |
|---|---|---|
| Microsoft Edge Stable below 152.0.4191.53 | Needs review/update | Open edge://settings/help, allow the update to finish, then relaunch Edge.[1][3] |
| Microsoft Edge Stable 152.0.4191.53 or later | Current for this release | Confirm the browser completed its restart and continue normal automatic updating.[1][3] |
| Managed business devices | Deployment-dependent | Check the managed Edge version, rollout rings, restart compliance, and any policy that defers browser updates. |
| Edge on macOS | Browser update; not a macOS OS release | Verify Edge’s own version. Apple did not issue a same-day macOS security/system release by the cutoff.[5][6] |
| Safari-only Mac users | Not affected by this Edge release | Continue normal Apple updates; the newest Apple Mac security entries remain Safari 26.6.1 on August 18 and macOS Tahoe 26.6.2 on August 17.[5] |
| Windows itself | No August 28 Windows OS release announcement in Microsoft’s Message Center at the cutoff | Keep the August Windows cumulative update installed, but do not confuse it with this separate Edge browser update.[4] |
What home users should do
- Check the version. In Edge, choose Settings and more → Help and feedback → About Microsoft Edge, or enter
edge://settings/help.[3] - Let the update finish. If Edge offers version 152.0.4191.53 or later, allow it to download.[1][3]
- Relaunch the browser. Save work in web apps first. A relaunch closes active Edge tabs and windows.[3]
- Verify again. Return to the About page and confirm 152.0.4191.53 or a later version.
- Do not install “Edge patches” from pop-ups. Use Edge’s built-in updater or Microsoft’s official download page.
What businesses should do
- Inventory actual versions. Report the full four-part Edge version—not only “Edge 152.”
- Separate download from restart compliance. A device can have update files present while users keep an older browser process open.
- Pilot critical web workflows. Test Microsoft 365, line-of-business portals, browser extensions, printing, downloads, authentication, and any kiosk or WebView2-dependent workflow.
- Use normal deployment controls. Preserve existing policy, ring, and rollback practices; do not disable browser security features to avoid an application-compatibility problem.
- Track exceptions. Assign an owner and deadline to devices that cannot reach the target version.
- Verify both Windows and Mac fleets. Edge’s browser version is a separate measurement from the Windows build or macOS version.
Good and bad operational trade-offs
The good: Edge browser updates are delivered separately from operating-system upgrades, automatic updating is built in, and a four-part version provides a concrete verification target. The bad: frequent browser releases can outpace restart habits, managed deferrals can leave mixed versions in one organization, and a very large CVE ledger can tempt readers to turn a record count into an exaggerated threat claim.
Windows and Apple check for August 28
Microsoft’s Windows Message Center had no August 28 announcement at the cutoff.[4] Its newest August 27 entries included the August Windows 11 non-security preview update and WMIC-removal guidance; the next-generation code-signing guidance was dated August 21.[4] Microsoft’s Windows Message Center identifies the August 11 security update as the month’s current broad Windows security baseline.[4] For the KB/build details, see our complete August 2026 Patch Tuesday guide.
Apple’s security-release table had no August 28 macOS entry.[5] The newest Mac-related security releases were Safari 26.6.1 on August 18 and macOS Tahoe 26.6.2 on August 17.[5] Apple’s developer page listed macOS 27 beta 7 on August 24, which remains a beta.[6] Apple’s Background Security Improvements page still showed the March 17 WebKit release as its latest dated entry.[6]
Frequently asked questions
Is this Patch Tuesday?
No. Edge 152.0.4191.53 is a browser security update on Edge’s own cadence.[1] The current August Windows Patch Tuesday release remains the August 11 B update.[4]
Does 304 mean Microsoft fixed 304 actively exploited zero-days?
No. It means Microsoft’s August CVRF document added 304 new Edge/Chromium CVE records with an August 28 initial revision.[2] The record count is not an active-attack count and is not a one-PC exposure count.
Were any of the Microsoft Edge-specific records marked exploited?
No Edge-branded record with an MSRC exploit-status field was marked exploited or publicly disclosed at the cutoff. That statement does not extend to the 295 Chromium records, which lacked Microsoft exploit-status fields in the CVRF snapshot.[2]
Why does Microsoft say August 27 while the CVEs say August 28?
The Edge Stable update is dated August 27.[1] Microsoft’s August CVRF document shows a 07:00 timestamp on August 28; the frozen source does not specify the timestamp’s timezone.[2] Those are two evidence layers: release availability and later security-document publication.
Do Mac users need this?
Mac users who run Microsoft Edge should verify Edge’s browser version.[1] This does not mean Apple released a new macOS update today, and Safari-only users are not affected by an Edge-specific release.[5]
What if Edge reports 152.0.4191.52?
Microsoft’s live security notes and CVRF remediation fields showed 152.0.4191.53 at the cutoff.[1][2] Let the About page check again, restart Edge, and verify the full version. If a managed device remains behind, contact the organization’s IT administrator rather than bypassing policy.
Official sources
- Microsoft: Release notes for Microsoft Edge Security Updates — Edge Stable 152.0.4191.53 and the seven-item Edge-specific list.
- Microsoft Security Response Center: August 2026 CVRF document — August 28 revision timestamp, 304 new Edge/Chromium records, individual titles, severities, exploit-status fields, and fixed-build data.
- Microsoft Support: Microsoft Edge update settings — automatic updating, restart behavior, and
edge://settings/help. - Microsoft Windows Message Center — same-day Windows advisory check and classification.
- Apple security releases — same-day negative check and latest Mac security-release dates.
- Apple Background Security Improvements by date and Apple Developer software releases — background-update and beta/production classification checks.
Original hero illustration by The IT Guys. It represents a browser security update and cross-platform verification; it is not a screenshot of a real warning or attack.