# Microsoft Edge WebView2 Runtime 148.0.3967.70 Microsoft Edge WebView2 Runtime 148.0.3967.70, released May 15, 2026, fixes 61 CVEs in Microsoft Edge WebView2 Runtime. None of them is reported as exploited. Patch Radar priority: Urgent. The latest Microsoft Edge WebView2 Runtime is 157.0.4341.42, which also fixes every one of these CVEs. - Web page: https://patchblox.com/security/fix/windows-app/microsoft.edgewebview2runtime-148.0.3967.70 - Platform: Windows apps - Released: May 15, 2026 - Priority: Urgent (Closes CVE-2026-8510, rated Critical) - CVEs: 61, exploited: 0, on CISA KEV: 0 - Superseded by: [Microsoft Edge WebView2 Runtime 157.0.4341.42](https://patchblox.com/security/data/product/windows-app/microsoft-edge-webview2-runtime.md), the latest version, which also fixes every CVE listed here ## Applies to | Product | Release | Fixed in | |---|---|---| | [Microsoft Edge WebView2 Runtime](https://patchblox.com/security/data/product/windows-app/microsoft-edge-webview2-runtime.md) | | 148.0.3967.70 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-8510](https://patchblox.com/security/data/cve/CVE-2026-8510.md) | Urgent | Chromium: CVE-2026-8510 Integer overflow in Skia | 9.6 | 0.0995 | | | [CVE-2026-45495](https://patchblox.com/security/data/cve/CVE-2026-45495.md) | Urgent | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 9.8 | 0.0099 | More likely | | [CVE-2026-45494](https://patchblox.com/security/data/cve/CVE-2026-45494.md) | Urgent | Microsoft Edge (Chromium-based) Spoofing Vulnerability | 6.1 | 0.0030 | More likely | | [CVE-2026-45492](https://patchblox.com/security/data/cve/CVE-2026-45492.md) | Urgent | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability | 5.4 | 0.0030 | More likely | | [CVE-2026-8511](https://patchblox.com/security/data/cve/CVE-2026-8511.md) | Urgent | Chromium: CVE-2026-8511 Use after free in UI | 9.6 | 0.0023 | | | [CVE-2026-8519](https://patchblox.com/security/data/cve/CVE-2026-8519.md) | Urgent | Chromium: CVE-2026-8519 Integer overflow in ANGLE | 9.6 | 0.0023 | | | [CVE-2026-8580](https://patchblox.com/security/data/cve/CVE-2026-8580.md) | Urgent | Chromium: CVE-2026-8580 Use after free in Mojo | 9.6 | 0.0021 | | | [CVE-2026-8556](https://patchblox.com/security/data/cve/CVE-2026-8556.md) | Urgent | Chromium: CVE-2026-8556 Inappropriate implementation in ANGLE | 9.6 | 0.0020 | | | [CVE-2026-8567](https://patchblox.com/security/data/cve/CVE-2026-8567.md) | Urgent | Chromium: CVE-2026-8567 Integer overflow in ANGLE | 9.6 | 0.0018 | | | [CVE-2026-8554](https://patchblox.com/security/data/cve/CVE-2026-8554.md) | Urgent | Chromium: CVE-2026-8554 Type Confusion in ANGLE | 9.6 | 0.0017 | | | [CVE-2026-8579](https://patchblox.com/security/data/cve/CVE-2026-8579.md) | Urgent | Chromium: CVE-2026-8579 Insufficient validation of untrusted input in Skia | 9.6 | 0.0014 | | | [CVE-2026-41107](https://patchblox.com/security/data/cve/CVE-2026-41107.md) | High | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability | 7.4 | 0.0065 | | | [CVE-2026-8509](https://patchblox.com/security/data/cve/CVE-2026-8509.md) | High | Chromium: CVE-2026-8509 Heap buffer overflow in WebML | 8.8 | 0.0040 | | | [CVE-2026-8524](https://patchblox.com/security/data/cve/CVE-2026-8524.md) | High | Chromium: CVE-2026-8524 Out of bounds write in WebAudio | 8.8 | 0.0038 | | | [CVE-2026-8526](https://patchblox.com/security/data/cve/CVE-2026-8526.md) | High | Chromium: CVE-2026-8526 Out of bounds write in WebRTC | 8.8 | 0.0038 | | | [CVE-2026-8558](https://patchblox.com/security/data/cve/CVE-2026-8558.md) | High | Chromium: CVE-2026-8558 Out of bounds write in Fonts | 8.8 | 0.0031 | | | [CVE-2026-8540](https://patchblox.com/security/data/cve/CVE-2026-8540.md) | High | Chromium: CVE-2026-8540 Type Confusion in V8 | 8.8 | 0.0031 | | | [CVE-2026-8529](https://patchblox.com/security/data/cve/CVE-2026-8529.md) | High | Chromium: CVE-2026-8529 Heap buffer overflow in Codecs | 8.8 | 0.0030 | | | [CVE-2026-8527](https://patchblox.com/security/data/cve/CVE-2026-8527.md) | High | Chromium: CVE-2026-8527 Insufficient validation of untrusted input in Downloads | 8.8 | 0.0029 | | | [CVE-2026-8518](https://patchblox.com/security/data/cve/CVE-2026-8518.md) | High | Chromium: CVE-2026-8518 Use after free in Blink | 8.8 | 0.0028 | | | [CVE-2026-8532](https://patchblox.com/security/data/cve/CVE-2026-8532.md) | High | Chromium: CVE-2026-8532 Integer overflow in XML | 8.8 | 0.0028 | | | [CVE-2026-8544](https://patchblox.com/security/data/cve/CVE-2026-8544.md) | High | Chromium: CVE-2026-8544 Use after free in Media | 8.8 | 0.0028 | | | [CVE-2026-8549](https://patchblox.com/security/data/cve/CVE-2026-8549.md) | High | Chromium: CVE-2026-8549 Use after free in Media | 8.8 | 0.0028 | | | [CVE-2026-8551](https://patchblox.com/security/data/cve/CVE-2026-8551.md) | High | Chromium: CVE-2026-8551 Use after free in Downloads | 8.8 | 0.0028 | | | [CVE-2026-8555](https://patchblox.com/security/data/cve/CVE-2026-8555.md) | High | Chromium: CVE-2026-8555 Use after free in GTK | 8.8 | 0.0028 | | | [CVE-2026-8530](https://patchblox.com/security/data/cve/CVE-2026-8530.md) | High | Chromium: CVE-2026-8530 Use after free in Network | 8.3 | 0.0027 | | | [CVE-2026-8581](https://patchblox.com/security/data/cve/CVE-2026-8581.md) | High | Chromium: CVE-2026-8581 Use after free in GPU | 8.8 | 0.0026 | | | [CVE-2026-8531](https://patchblox.com/security/data/cve/CVE-2026-8531.md) | High | Chromium: CVE-2026-8531 Heap buffer overflow in WebML | 8.8 | 0.0026 | | | [CVE-2026-8547](https://patchblox.com/security/data/cve/CVE-2026-8547.md) | High | Chromium: CVE-2026-8547 Insufficient policy enforcement in Passwords | 7.5 | 0.0026 | | | [CVE-2026-8512](https://patchblox.com/security/data/cve/CVE-2026-8512.md) | High | Chromium: CVE-2026-8512 Use after free in FileSystem | 8.3 | 0.0025 | | | [CVE-2026-8577](https://patchblox.com/security/data/cve/CVE-2026-8577.md) | High | Chromium: CVE-2026-8577 Integer overflow in Fonts | 8.8 | 0.0025 | | | [CVE-2026-8573](https://patchblox.com/security/data/cve/CVE-2026-8573.md) | High | Chromium: CVE-2026-8573 Integer overflow in Codecs | 8.3 | 0.0023 | | | [CVE-2026-8514](https://patchblox.com/security/data/cve/CVE-2026-8514.md) | High | Chromium: CVE-2026-8514 Use after free in Aura | 8.3 | 0.0021 | | | [CVE-2026-8515](https://patchblox.com/security/data/cve/CVE-2026-8515.md) | High | Chromium: CVE-2026-8515 Use after free in HID | 8.3 | 0.0021 | | | [CVE-2026-8523](https://patchblox.com/security/data/cve/CVE-2026-8523.md) | High | Chromium: CVE-2026-8523 Use after free in Mojo | 8.3 | 0.0021 | | | [CVE-2026-8533](https://patchblox.com/security/data/cve/CVE-2026-8533.md) | High | Chromium: CVE-2026-8533 Use after free in Accessibility | 8.3 | 0.0021 | | | [CVE-2026-8542](https://patchblox.com/security/data/cve/CVE-2026-8542.md) | High | Chromium: CVE-2026-8542 Use after free in Core | 8.3 | 0.0021 | | | [CVE-2026-8548](https://patchblox.com/security/data/cve/CVE-2026-8548.md) | High | Chromium: CVE-2026-8548 Out of bounds write in Media | 8.3 | 0.0021 | | | [CVE-2026-8557](https://patchblox.com/security/data/cve/CVE-2026-8557.md) | High | Chromium: CVE-2026-8557 Use after free in Accessibility | 7.5 | 0.0021 | | | [CVE-2026-8574](https://patchblox.com/security/data/cve/CVE-2026-8574.md) | High | Chromium: CVE-2026-8574 Use after free in Core | 8.3 | 0.0018 | | | [CVE-2026-8575](https://patchblox.com/security/data/cve/CVE-2026-8575.md) | High | Chromium: CVE-2026-8575 Use after free in UI | 8.3 | 0.0018 | | | [CVE-2026-8520](https://patchblox.com/security/data/cve/CVE-2026-8520.md) | High | Chromium: CVE-2026-8520 Race in Payments | 8.3 | 0.0017 | | | [CVE-2026-8521](https://patchblox.com/security/data/cve/CVE-2026-8521.md) | High | Chromium: CVE-2026-8521 Use after free in Tab Groups | 7.5 | 0.0016 | | | [CVE-2026-40416](https://patchblox.com/security/data/cve/CVE-2026-40416.md) | Routine | Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability | 4.3 | 0.0035 | | | [CVE-2026-8570](https://patchblox.com/security/data/cve/CVE-2026-8570.md) | Routine | Chromium: CVE-2026-8570 Type Confusion in V8 | 6.5 | 0.0025 | | | [CVE-2026-42838](https://patchblox.com/security/data/cve/CVE-2026-42838.md) | Routine | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | 5.4 | 0.0024 | | | [CVE-2026-8550](https://patchblox.com/security/data/cve/CVE-2026-8550.md) | Routine | Chromium: CVE-2026-8550 Use after free in Google Lens | 6.5 | 0.0023 | | | [CVE-2026-8516](https://patchblox.com/security/data/cve/CVE-2026-8516.md) | Routine | Chromium: CVE-2026-8516 Insufficient validation of untrusted input in DataTransfer | 5.3 | 0.0022 | | | [CVE-2026-8541](https://patchblox.com/security/data/cve/CVE-2026-8541.md) | Routine | Chromium: CVE-2026-8541 Out of bounds read in UI | 5.3 | 0.0021 | | | [CVE-2026-8546](https://patchblox.com/security/data/cve/CVE-2026-8546.md) | Routine | Chromium: CVE-2026-8546 Out of bounds read in GPU | 5.3 | 0.0021 | | | [CVE-2026-8528](https://patchblox.com/security/data/cve/CVE-2026-8528.md) | Routine | Chromium: CVE-2026-8528 Insufficient validation of untrusted input in SiteIsolation | 4.3 | 0.0020 | | | [CVE-2026-8538](https://patchblox.com/security/data/cve/CVE-2026-8538.md) | Routine | Chromium: CVE-2026-8538 Insufficient validation of untrusted input in GPU | 5.3 | 0.0020 | | | [CVE-2026-8582](https://patchblox.com/security/data/cve/CVE-2026-8582.md) | Routine | Chromium: CVE-2026-8582 Object lifecycle issue in Dawn | 5.3 | 0.0019 | | | [CVE-2026-8562](https://patchblox.com/security/data/cve/CVE-2026-8562.md) | Routine | Chromium: CVE-2026-8562 Side-channel information leakage in Navigation | 4.3 | 0.0019 | | | [CVE-2026-8561](https://patchblox.com/security/data/cve/CVE-2026-8561.md) | Routine | Chromium: CVE-2026-8561 Incorrect security UI in Fullscreen | 5.4 | 0.0018 | | | [CVE-2026-8563](https://patchblox.com/security/data/cve/CVE-2026-8563.md) | Routine | Chromium: CVE-2026-8563 Insufficient policy enforcement in IFrame Sandbox | 4.3 | 0.0018 | | | [CVE-2026-8537](https://patchblox.com/security/data/cve/CVE-2026-8537.md) | Routine | Chromium: CVE-2026-8537 Insufficient policy enforcement in ViewTransitions | 4.3 | 0.0018 | | | [CVE-2026-8559](https://patchblox.com/security/data/cve/CVE-2026-8559.md) | Routine | Chromium: CVE-2026-8559 Integer overflow in Internationalization | 4.3 | 0.0018 | | | [CVE-2026-8545](https://patchblox.com/security/data/cve/CVE-2026-8545.md) | Routine | Chromium: CVE-2026-8545 Object corruption in Compositing | 3.1 | 0.0016 | | | [CVE-2026-8553](https://patchblox.com/security/data/cve/CVE-2026-8553.md) | Routine | Chromium: CVE-2026-8553 Use after free in GPU | 3.1 | 0.0016 | | | [CVE-2026-8586](https://patchblox.com/security/data/cve/CVE-2026-8586.md) | Routine | Chromium: CVE-2026-8586 Inappropriate implementation in Chromoting | 5.5 | 0.0010 | | --- Data as of 2026-11-11T07:45:43Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.