Microsoft Edge WebView2 Runtime 128.0.2739.42
Microsoft Edge WebView2 Runtime 128.0.2739.42, released August 22, 2024, fixes 23 CVEs in Microsoft Edge WebView2 Runtime. 2 of them are being exploited (CVE-2024-7971); 2 on CISA KEV. Patch Radar priority: Patch now. The latest Microsoft Edge WebView2 Runtime is 157.0.4341.42, which also fixes every one of these CVEs.
Superseded. The latest Microsoft Edge WebView2 Runtime is 157.0.4341.42, which also fixes every CVE on this page. Install that instead.
Priority of the 23 CVEs
Applies to
| Product | Version |
|---|---|
| Microsoft Edge WebView2 Runtime | 128.0.2739.42 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Patch now | CVE-2024-7971 | Chromium: CVE-2024-7971 Type confusion in V8 | 9.6 | 0.2101 | KEVExploited |
| Patch now | CVE-2024-7965 | Chromium: CVE-2024-7965 Inappropriate implementation in V8 | 8.8 | 0.1853 | KEVExploited |
| Urgent | CVE-2024-7966 | Chromium: CVE-2024-7966 Out of bounds memory access in Skia | 9.6 | 0.0071 | None reported |
| High | CVE-2024-7973 | Chromium: CVE-2024-7973 Heap buffer overflow in PDFium | 8.8 | 0.0077 | None reported |
| High | CVE-2024-38209 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 7.8 | 0.0065 | Exploitation Less Likely |
| High | CVE-2024-38210 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 7.8 | 0.0065 | Exploitation Less Likely |
| High | CVE-2024-7967 | Chromium: CVE-2024-7967 Heap buffer overflow in Fonts | 8.8 | 0.0061 | None reported |
| High | CVE-2024-7972 | Chromium: CVE-2024-7972 Inappropriate implementation in V8 | 8.8 | 0.0059 | None reported |
| High | CVE-2024-7968 | Chromium: CVE-2024-7968 Use after free in Autofill | 8.8 | 0.0058 | None reported |
| High | CVE-2024-7969 | Chromium: CVE-2024-7969 Type Confusion in V8 | 8.8 | 0.0050 | None reported |
| High | CVE-2024-7974 | Chromium: CVE-2024-7974 Insufficient data validation in V8 API | 8.8 | 0.0049 | None reported |
| High | CVE-2024-41879 | Adobe Systems Incorporated: CVE-2024-41879 Adobe PDF Viewer Remote Code Execution Vulnerability | 7.8 | 0.0048 | Exploitation Less Likely |
| High | CVE-2024-7977 | Chromium: CVE-2024-7977 Insufficient data validation in Installer | 7.8 | 0.0034 | None reported |
| High | CVE-2024-7980 | Chromium: CVE-2024-7980 Insufficient data validation in Installer | 7.8 | 0.0026 | None reported |
| High | CVE-2024-7979 | Chromium: CVE-2024-7979 Insufficient data validation in Installer | 7.8 | 0.0022 | None reported |
| Routine | CVE-2024-38222 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability | 6.5 | 0.0119 | Exploitation Less Likely |
| Routine | CVE-2024-7976 | Chromium: CVE-2024-7976 Inappropriate implementation in FedCM | 4.3 | 0.0046 | None reported |
| Routine | CVE-2024-7978 | Chromium: CVE-2024-7978 Insufficient policy enforcement in Data Transfer | 4.3 | 0.0045 | None reported |
| Routine | CVE-2024-7975 | Chromium: CVE-2024-7975 Inappropriate implementation in Permissions | 4.3 | 0.0044 | None reported |
| Routine | CVE-2024-7981 | Chromium: CVE-2024-7981 Inappropriate implementation in Views | 4.3 | 0.0043 | None reported |
| Routine | CVE-2024-38207 | Microsoft Edge (HTML-based) Memory Corruption Vulnerability | 6.3 | 0.0040 | Exploitation Less Likely |
| Routine | CVE-2024-8035 | Chromium: CVE-2024-8035 Inappropriate implementation in Extensions | 4.3 | 0.0033 | None reported |
| Routine | CVE-2024-8033 | Chromium: CVE-2024-8033 Inappropriate implementation in WebApp Installs | 4.3 | 0.0030 | None reported |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.