Microsoft Edge < 124.0.2478.97 — RCE
A use-after-free in the Chromium Visuals component (shared with Edge) allows remote code execution. Update Edge to 124.0.2478.105 or later — this is a Chromium zero-day that affected Edge, Chrome, and all Chromium-based browsers simultaneously.
An attacker hosting a malicious website can trigger code execution in the Edge renderer process. Combined with a sandbox escape, this enables system-level compromise. Even within the sandbox, attackers can steal session cookies and browser-stored passwords.
The Chromium Visuals component handles rendering of web content. A use-after-free vulnerability in this component can be triggered by a specially crafted web page, allowing heap memory corruption that may lead to code execution within the browser process.
📧
Phishing link
🖼
Malicious file
🔓
Server compromised
Probably yes if any of these apply:
Affected OS versions
Google disclosed CVE-2024-4671 as an actively exploited zero-day in Chrome on May 9, 2024. Microsoft shipped an Edge update incorporating the Chromium fix the same day. This was the sixth Chrome zero-day patched in 2024. Both CISA and Microsoft urged immediate updates, as the vulnerability affects all Chromium-based browsers including Edge and Brave.
Manual remediation steps
⏱ 5 minutes (browser restart only)Apply the Microsoft Security Update
This vulnerability is fixed by Microsoft's official security update.
Affected Products
Installation Methods
Windows Update (recommended)
Verification
Confirm the update is installed:
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
References
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
References