Microsoft fixes five security vulnerabilities in Edge 123

Microsoft is rolling out a new Edge update for version 123 in the Stable Channel. 123.0.2420.81 does not bring new features or notable changes. Instead, it fixes five security vulnerabilities within the browser. Three are the latest Chromium security patches, and the other two are Microsoft Edge-specific.

The update is also available for users in the Extended Stable Release Channel. They received version 122.0.2365.120 with the same security patches.

Version 123.0.2420.81: April 4, 2024

 

Fixed various bugs and performance issues.

 

Microsoft has released the latest Microsoft Edge Stable Channel (Version 123.0.2420.81) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide.

 

This update contains the following Microsoft Edge-specific update:

 

• CVE-2024-29981
• CVE-2024-29049

CVE-2024-29981 is a spoofing vulnerability (marked as low severity) that requires local access to the target device or opening a specifically crafted file.

CVE-2024-29049 is a WebView2 spoofing vulnerability of high complexity and moderate severity. According to Microsoft, exploiting it requires an attacker to take additional actions prior to exploitation to prepare the target environment. Although the vulnerability is within the web server, malicious code runs on a victim's local machine. CVE-2024-29049 also requires opening an infected file.

The latest Chromium patches contain fixes for three vulnerabilities:

• Chromium: CVE-2024-3156 Inappropriate implementation in V8

• Chromium: CVE-2024-3158 Use after free in Bookmarks

• Chromium: CVE-2024-3159 Out of bounds memory access in V8

   

Microsoft Edge will download available updates in the background as you use the browser and install the latest version upon the next restart. You can always force-update the browser by heading to edge://settings/help.

In case you missed it, Microsoft recently released the first build of Edge 125 in the Dev Channel. Version 124 is currently being tested in the Beta Channel, with the Stable release scheduled for the week of April 18, 2024.

Source