# Microsoft Edge WebView2 Runtime 154.0.4258.48 Microsoft Edge WebView2 Runtime 154.0.4258.48, released September 29, 2026, fixes 59 CVEs in Microsoft Edge WebView2 Runtime. None of them is reported as exploited. Patch Radar priority: Urgent. The latest Microsoft Edge WebView2 Runtime is 157.0.4341.42, which also fixes every one of these CVEs. - Web page: https://patchblox.com/security/fix/windows-app/microsoft.edgewebview2runtime-154.0.4258.48 - Platform: Windows apps - Released: Sep 29, 2026 - Priority: Urgent (Closes CVE-2026-96202, rated Critical) - CVEs: 59, exploited: 0, on CISA KEV: 0 - Superseded by: [Microsoft Edge WebView2 Runtime 157.0.4341.42](https://patchblox.com/security/data/product/windows-app/microsoft-edge-webview2-runtime.md), the latest version, which also fixes every CVE listed here ## Applies to | Product | Release | Fixed in | |---|---|---| | [Microsoft Edge WebView2 Runtime](https://patchblox.com/security/data/product/windows-app/microsoft-edge-webview2-runtime.md) | | 154.0.4258.48 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-96202](https://patchblox.com/security/data/cve/CVE-2026-96202.md) | Urgent | Windows Raw Image Extension Remote Code Execution Vulnerability | 8.8 | 0.0093 | | | [CVE-2026-95339](https://patchblox.com/security/data/cve/CVE-2026-95339.md) | Urgent | Chromium CVE-2026-95339: Use after free in ServiceWorker | 9.6 | 0.0047 | | | [CVE-2026-95310](https://patchblox.com/security/data/cve/CVE-2026-95310.md) | Urgent | Chromium CVE-2026-95310: Use after free in AdFilter | 9.6 | 0.0045 | | | [CVE-2026-95313](https://patchblox.com/security/data/cve/CVE-2026-95313.md) | Urgent | Chromium CVE-2026-95313: Use after free in Fullscreen | 9.6 | 0.0045 | | | [CVE-2026-83831](https://patchblox.com/security/data/cve/CVE-2026-83831.md) | High | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 8.8 | 0.0075 | | | [CVE-2026-85898](https://patchblox.com/security/data/cve/CVE-2026-85898.md) | High | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 8.8 | 0.0075 | | | [CVE-2026-95318](https://patchblox.com/security/data/cve/CVE-2026-95318.md) | High | Chromium CVE-2026-95318: Buffer overflow in Video | 9.6 | 0.0039 | | | [CVE-2026-95343](https://patchblox.com/security/data/cve/CVE-2026-95343.md) | High | Chromium CVE-2026-95343: Use after free in WebAudio | 8.8 | 0.0037 | | | [CVE-2026-95282](https://patchblox.com/security/data/cve/CVE-2026-95282.md) | High | Chromium CVE-2026-95282: Use after free in Platform | 8.8 | 0.0035 | | | [CVE-2026-95311](https://patchblox.com/security/data/cve/CVE-2026-95311.md) | High | Chromium CVE-2026-95311: Free of non-heap memory in Fonts | 9.6 | 0.0035 | | | [CVE-2026-95325](https://patchblox.com/security/data/cve/CVE-2026-95325.md) | High | Chromium CVE-2026-95325: Use after free in ANGLE | 9.6 | 0.0035 | | | [CVE-2026-95299](https://patchblox.com/security/data/cve/CVE-2026-95299.md) | High | Chromium CVE-2026-95299: Use after free in GPU | 9.6 | 0.0034 | | | [CVE-2026-95286](https://patchblox.com/security/data/cve/CVE-2026-95286.md) | High | Chromium CVE-2026-95286: Type confusion in Bindings | 8.8 | 0.0034 | | | [CVE-2026-95304](https://patchblox.com/security/data/cve/CVE-2026-95304.md) | High | Chromium CVE-2026-95304: Out of bounds write in V8 | 8.8 | 0.0034 | | | [CVE-2026-95306](https://patchblox.com/security/data/cve/CVE-2026-95306.md) | High | Chromium CVE-2026-95306: Type confusion in V8 | 8.8 | 0.0033 | | | [CVE-2026-95365](https://patchblox.com/security/data/cve/CVE-2026-95365.md) | High | Chromium CVE-2026-95365: Type confusion in IndexedDB | 8.8 | 0.0032 | | | [CVE-2026-95334](https://patchblox.com/security/data/cve/CVE-2026-95334.md) | High | Chromium CVE-2026-95334: Incorrect reference resolution in WebProtect | 8.3 | 0.0032 | | | [CVE-2026-95326](https://patchblox.com/security/data/cve/CVE-2026-95326.md) | High | Chromium CVE-2026-95326: Incomplete cleanup in Bluetooth | 8.4 | 0.0032 | | | [CVE-2026-95333](https://patchblox.com/security/data/cve/CVE-2026-95333.md) | High | Chromium CVE-2026-95333: Use after free in Metrics | 8.1 | 0.0031 | | | [CVE-2026-95274](https://patchblox.com/security/data/cve/CVE-2026-95274.md) | High | Chromium CVE-2026-95274: Improper output encoding in DevTools | 8.3 | 0.0030 | | | [CVE-2026-95353](https://patchblox.com/security/data/cve/CVE-2026-95353.md) | High | Chromium CVE-2026-95353: Use after free in Bindings | 8.8 | 0.0030 | | | [CVE-2026-95335](https://patchblox.com/security/data/cve/CVE-2026-95335.md) | High | Chromium CVE-2026-95335: Use after free in HID | 8.3 | 0.0030 | | | [CVE-2026-95341](https://patchblox.com/security/data/cve/CVE-2026-95341.md) | High | Chromium CVE-2026-95341: Improper input validation in Desktop | 8.3 | 0.0029 | | | [CVE-2026-95348](https://patchblox.com/security/data/cve/CVE-2026-95348.md) | High | Chromium CVE-2026-95348: Use after free in Bluetooth | 8.3 | 0.0028 | | | [CVE-2026-95373](https://patchblox.com/security/data/cve/CVE-2026-95373.md) | High | Chromium CVE-2026-95373: Use after free in DevTools | 8.8 | 0.0027 | | | [CVE-2026-95354](https://patchblox.com/security/data/cve/CVE-2026-95354.md) | High | Chromium CVE-2026-95354: Use after free in Verifier | 8.3 | 0.0027 | | | [CVE-2026-95380](https://patchblox.com/security/data/cve/CVE-2026-95380.md) | High | Chromium CVE-2026-95380: Type confusion in V8 | 8.8 | 0.0026 | | | [CVE-2026-95278](https://patchblox.com/security/data/cve/CVE-2026-95278.md) | High | Chromium CVE-2026-95278: Missing authorization in WakeLock | 8.4 | 0.0025 | | | [CVE-2026-95369](https://patchblox.com/security/data/cve/CVE-2026-95369.md) | High | Chromium CVE-2026-95369: Inappropriate implementation in XML | 8.8 | 0.0025 | | | [CVE-2026-95314](https://patchblox.com/security/data/cve/CVE-2026-95314.md) | High | Chromium CVE-2026-95314: Incorrect authorization in HID | 8.1 | 0.0024 | | | [CVE-2026-95372](https://patchblox.com/security/data/cve/CVE-2026-95372.md) | High | Chromium CVE-2026-95372: Use after free in Chromecast | 8.3 | 0.0024 | | | [CVE-2026-95280](https://patchblox.com/security/data/cve/CVE-2026-95280.md) | High | Chromium CVE-2026-95280: Race condition in V8 | 7.5 | 0.0021 | | | [CVE-2026-95298](https://patchblox.com/security/data/cve/CVE-2026-95298.md) | High | Chromium CVE-2026-95298: Use after free in Browser | 7.8 | 0.0016 | | | [CVE-2026-95362](https://patchblox.com/security/data/cve/CVE-2026-95362.md) | High | Chromium CVE-2026-95362: Cross-site request forgery in DevTools | 8.8 | 0.0016 | | | [CVE-2026-95275](https://patchblox.com/security/data/cve/CVE-2026-95275.md) | Routine | Chromium CVE-2026-95275: Incorrect reference resolution in MediaStream | 6.5 | 0.0027 | | | [CVE-2026-95327](https://patchblox.com/security/data/cve/CVE-2026-95327.md) | Routine | Chromium CVE-2026-95327: Information leak in Networking | 6.5 | 0.0025 | | | [CVE-2026-95336](https://patchblox.com/security/data/cve/CVE-2026-95336.md) | Routine | Chromium CVE-2026-95336: Information leak in Transactions Platform | 6.5 | 0.0025 | | | [CVE-2026-95293](https://patchblox.com/security/data/cve/CVE-2026-95293.md) | Routine | Chromium CVE-2026-95293: Uninitialized resource in GPU | 4.7 | 0.0024 | | | [CVE-2026-95382](https://patchblox.com/security/data/cve/CVE-2026-95382.md) | Routine | Chromium CVE-2026-95382: Improper input validation in Auth | 6.5 | 0.0023 | | | [CVE-2026-95289](https://patchblox.com/security/data/cve/CVE-2026-95289.md) | Routine | Chromium CVE-2026-95289: Incorrect authorization in Scroll | 4.3 | 0.0023 | | | [CVE-2026-95330](https://patchblox.com/security/data/cve/CVE-2026-95330.md) | Routine | Chromium CVE-2026-95330: Improper state validation in Downloads | 6.5 | 0.0023 | | | [CVE-2026-95366](https://patchblox.com/security/data/cve/CVE-2026-95366.md) | Routine | Chromium CVE-2026-95366: Use of released resource in Core | 6.5 | 0.0022 | | | [CVE-2026-95300](https://patchblox.com/security/data/cve/CVE-2026-95300.md) | Routine | Chromium CVE-2026-95300: Missing authorization in DevTools | 4.8 | 0.0022 | | | [CVE-2026-95342](https://patchblox.com/security/data/cve/CVE-2026-95342.md) | Routine | Chromium CVE-2026-95342: Missing authorization in V8 | 4.3 | 0.0022 | | | [CVE-2026-95367](https://patchblox.com/security/data/cve/CVE-2026-95367.md) | Routine | Chromium CVE-2026-95367: Information leak in DataTransfer | 5.3 | 0.0021 | | | [CVE-2026-95324](https://patchblox.com/security/data/cve/CVE-2026-95324.md) | Routine | Chromium CVE-2026-95324: Uninitialized resource in GPU | 3.4 | 0.0021 | | | [CVE-2026-95363](https://patchblox.com/security/data/cve/CVE-2026-95363.md) | Routine | Chromium CVE-2026-95363: UI misrepresentation in FileSystem | 5.4 | 0.0021 | | | [CVE-2026-95320](https://patchblox.com/security/data/cve/CVE-2026-95320.md) | Routine | Chromium CVE-2026-95320: Missing authorization in Navigation | 5.4 | 0.0021 | | | [CVE-2026-95368](https://patchblox.com/security/data/cve/CVE-2026-95368.md) | Routine | Chromium CVE-2026-95368: Incorrect authorization in DevTools | 4.3 | 0.0020 | | | [CVE-2026-95340](https://patchblox.com/security/data/cve/CVE-2026-95340.md) | Routine | Chromium CVE-2026-95340: Incorrect authorization in PictureInPicture | 4.3 | 0.0020 | | | [CVE-2026-95287](https://patchblox.com/security/data/cve/CVE-2026-95287.md) | Routine | Chromium CVE-2026-95287: Missing authorization in Navigation | 5.4 | 0.0020 | | | [CVE-2026-95290](https://patchblox.com/security/data/cve/CVE-2026-95290.md) | Routine | Chromium CVE-2026-95290: Missing authorization in NFC | 5.4 | 0.0020 | | | [CVE-2026-95308](https://patchblox.com/security/data/cve/CVE-2026-95308.md) | Routine | Chromium CVE-2026-95308: Integer overflow in Metrics | 3.4 | 0.0019 | | | [CVE-2026-95361](https://patchblox.com/security/data/cve/CVE-2026-95361.md) | Routine | Chromium CVE-2026-95361: Confused deputy in DevTools | 4.3 | 0.0019 | | | [CVE-2026-95374](https://patchblox.com/security/data/cve/CVE-2026-95374.md) | Routine | Chromium CVE-2026-95374: Incorrect authorization in Network | 6.5 | 0.0019 | | | [CVE-2026-95360](https://patchblox.com/security/data/cve/CVE-2026-95360.md) | Routine | Chromium CVE-2026-95360: Race condition in Editing | 5.3 | 0.0018 | | | [CVE-2026-95352](https://patchblox.com/security/data/cve/CVE-2026-95352.md) | Routine | Chromium CVE-2026-95352: Incorrect authorization in DevTools | 5.4 | 0.0017 | | | [CVE-2026-95384](https://patchblox.com/security/data/cve/CVE-2026-95384.md) | Routine | Chromium CVE-2026-95384: Race condition in Transactions Platform | 5.3 | 0.0017 | | | [CVE-2026-95370](https://patchblox.com/security/data/cve/CVE-2026-95370.md) | Routine | Chromium CVE-2026-95370: Inappropriate implementation in NFC | 5.4 | 0.0016 | | --- Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.