Microsoft Edge gets fixes for zero-day vulnerabilities exploited in the wild

Microsoft recently re-released Edge 123 in the Stable Channel. The company pulled the update earlier to resolve compatibility issues with certain enterprise configurations. Now, the update is back with the necessary fix and four zero-day vulnerability fixes that, according to Microsoft, are exploited in the wild.

Here is the official changelog:

Version 123.0.2420.65

 

Fixed various bugs and performance issues, includes security fixes, and improves reliability:

 

• Fixed a browser crash that occurred when the UserDataDir policy is used to specify a path on a network share. Note that using a network share location for the user data directory is generally unsupported.
• Microsoft has a fix for CVE-2024-2883 to Microsoft Edge Stable Channel (Version 123.0.2420.65) and Extended Stable Channel (Version 122.0.2365.113), which has been reported by the Chromium team as having an exploit in the wild.

Security patches are available in version 123 in the Stable Channel and version 122 in the Extended Stable Channel. Patched vulnerabilities include CVE-2024-2887 "Type Confusion in WebAssembly," CVE-2024-2886 "Use after free in WebCodecs," CVE-2024-2885 "Use after free in Dawn," and CVE-2024-2883 "Use after free in ANGLE."

You can update Microsoft Edge by heading to edge://settings/help. Since the patched vulnerabilities are actively exploited, everyone better hurry up and get to version 123.0.2420.65. An offline installer can be found on the official website.

The update will also install an 8KB "Microsoft Copilot" app, which, according to Microsoft, is related to the upcoming Copilot features. They will let you ask Copilot to tweak settings, get device info, launch accessibility features, and more. Those features are currently available only to Windows Insiders with preview builds, and why Microsoft released that small app to users in the Stable Channel remains unknown.

More information about the latest Microsoft Edge update is available here. Security notes have a separate page in the official documentation.

Source