Microsoft Edge For Ios
Monthly
Use-after-free memory corruption in Microsoft Edge (Chromium-based) can let remote attackers execute arbitrary code in the browser process after the victim renders attacker-controlled web content in an unpatched build prior to 152.0.4191.52. All supported platforms are in scope - desktop Chromium-based Edge plus Edge for Android, iOS, Linux, and macOS - so the affected install base is broad even though the observed risk signal is currently low. Microsoft rates this 8.8 with a PR:L/UI:N vector while the independent assessment treats it as unauthenticated remote code execution that requires a targeted user to open or render a malicious or compromised page (PR:N/UI:R); no public exploit code has been identified and CISA's SSVC records exploitation as none, with EPSS at only 0.62% (48th percentile).
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop applications that allows remote attackers to disclose sensitive information through crafted AI prompts. The vulnerability affects numerous Microsoft products across iOS, Android, and macOS platforms, requires user interaction, and has a patch available from Microsoft with no current evidence of active exploitation (not in KEV).
Prompt injection in Microsoft Edge for iOS exposes users to network-based spoofing attacks through Microsoft Edge's AI/Copilot integration. Malicious web content can embed adversarial LLM prompts that, when processed by Edge's AI features, manipulate the model to produce spoofed or misleading output - potentially impersonating trusted content or bypassing AI-enforced guardrails. The CVSS vector (PR:N/UI:R) indicates no attacker authentication is required, but a user must interact with Edge on iOS while AI features are active. No public exploit code has been identified at time of analysis, and a vendor-released patch is available via MSRC.
Use-after-free memory corruption in Microsoft Edge (Chromium-based) can let remote attackers execute arbitrary code in the browser process after the victim renders attacker-controlled web content in an unpatched build prior to 152.0.4191.52. All supported platforms are in scope - desktop Chromium-based Edge plus Edge for Android, iOS, Linux, and macOS - so the affected install base is broad even though the observed risk signal is currently low. Microsoft rates this 8.8 with a PR:L/UI:N vector while the independent assessment treats it as unauthenticated remote code execution that requires a targeted user to open or render a malicious or compromised page (PR:N/UI:R); no public exploit code has been identified and CISA's SSVC records exploitation as none, with EPSS at only 0.62% (48th percentile).
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop applications that allows remote attackers to disclose sensitive information through crafted AI prompts. The vulnerability affects numerous Microsoft products across iOS, Android, and macOS platforms, requires user interaction, and has a patch available from Microsoft with no current evidence of active exploitation (not in KEV).
Prompt injection in Microsoft Edge for iOS exposes users to network-based spoofing attacks through Microsoft Edge's AI/Copilot integration. Malicious web content can embed adversarial LLM prompts that, when processed by Edge's AI features, manipulate the model to produce spoofed or misleading output - potentially impersonating trusted content or bypassing AI-enforced guardrails. The CVSS vector (PR:N/UI:R) indicates no attacker authentication is required, but a user must interact with Edge on iOS while AI features are active. No public exploit code has been identified at time of analysis, and a vendor-released patch is available via MSRC.