CVE‑2026‑39829: Edge Memory‑Leak Vulnerability

Impact

• Critical (CVSS 9.8).
• Arbitrary memory read in Edge 124.0.2361.0‑124.0.2361.3.
• Attackers can capture credentials, cookies, or encryption keys.
• Vulnerable to drive‑by exploitation via malicious web content.

Affected Products

• Microsoft Edge (Chromium‑based) 124.0.2361.0 – 124.0.2361.3 on Windows, macOS, and Linux.
• All bundled Edge versions in Windows 11 and Windows Server 2022.
• Edge for Android and iOS are unaffected.

Technical Details

The flaw resides in the SharedArrayBuffer implementation. When a malicious page allocates a buffer and triggers a race condition during memory mapping, the browser can read beyond the buffer’s bounds. The read operation bypasses the sandbox, exposing private process memory. Attackers can then parse the memory to extract secrets.

How It Works

1. Buffer Allocation – The page creates a large SharedArrayBuffer.
2. Race Trigger – A timing attack forces the buffer to be re‑mapped.
3. Out‑of‑Bounds Read – The browser reads memory past the buffer’s end.
4. Data Extraction – Secrets such as cookies or keys are reconstructed.

Exploit Example

A crafted HTML page can be hosted on a compromised site. When a user visits, the script runs silently and collects the victim’s session token. The token is then sent to the attacker’s server.

Severity

• CVSS Base Score: 9.8
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (user must visit malicious page)

Mitigation Steps

1. Update Edge Immediately – Install the latest patch (124.0.2361.4 or newer).
   • Windows: Use Windows Update or download from the Microsoft Edge Developer site.
   • macOS/Linux: Use the package manager or download the installer.
2. Disable SharedArrayBuffer – If immediate update is impossible, set the following flag in Edge’s about:flags:
   • --disable-shared-array-buffer.
   • Note: This may break performance‑critical web applications.
3. Network Controls – Block access to known malicious domains via DNS filtering.
4. Educate Users – Warn staff about suspicious links and phishing emails.

Timeline

• 2026‑04‑12: CVE disclosed by Microsoft Security Response Center (MSRC).
• 2026‑04‑15: Patch released for all supported Edge versions.
• 2026‑04‑20: Advisory issued to all enterprise customers.
• 2026‑05‑01: Edge 124.0.2361.4 becomes the default update.

What to Do Now

1. Verify your Edge version: open Edge, click the three dots, select Help & feedback → About Microsoft Edge.
2. If you are on a vulnerable build, update immediately.
3. If you cannot update, apply the flag mentioned above.
4. Monitor logs for unusual memory access patterns.
5. Report any suspected exploitation to Microsoft via the Security Response Portal.

Further Reading

• Microsoft Security Advisory: CVE‑2026‑39829
• Edge Security Documentation: Microsoft Edge Security
• SharedArrayBuffer Overview: MDN Web Docs

Stay vigilant. Update now.