Microsoft Edge WebView2 Runtime 149.0.4022.62
Microsoft Edge WebView2 Runtime 149.0.4022.62, released June 9, 2026, fixes 56 CVEs in Microsoft Edge WebView2 Runtime. One of them is being exploited (CVE-2026-11645); 1 on CISA KEV. Patch Radar priority: Patch now. The latest Microsoft Edge WebView2 Runtime is 157.0.4341.42, which also fixes every one of these CVEs.
Superseded. The latest Microsoft Edge WebView2 Runtime is 157.0.4341.42, which also fixes every CVE on this page. Install that instead.
Priority of the 56 CVEs
Applies to
| Product | Version |
|---|---|
| Microsoft Edge WebView2 Runtime | 149.0.4022.62 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Patch now | CVE-2026-11645 | Chromium: CVE-2026-11645 Out of bounds memory access in V8 | 8.8 | 0.0244 | KEVExploited |
| Urgent | CVE-2026-10883 | Chromium: CVE-2026-10883 Out of bounds write in ANGLE | 9.6 | 0.0063 | None reported |
| Urgent | CVE-2026-11065 | Chromium: CVE-2026-11065 Use after free in ANGLE | 9.6 | 0.0034 | None reported |
| Urgent | CVE-2026-11651 | Chromium: CVE-2026-11651 Use after free in Network | 9.6 | 0.0034 | None reported |
| Urgent | CVE-2026-11634 | Chromium: CVE-2026-11634 Use after free in Gamepad | 9.6 | 0.0025 | None reported |
| Urgent | CVE-2026-11638 | Chromium: CVE-2026-11638 Use after free in Printing | 9.6 | 0.0025 | None reported |
| Urgent | CVE-2026-11671 | Chromium: CVE-2026-11671 Use after free in Navigation | 9.6 | 0.0024 | None reported |
| Urgent | CVE-2026-11663 | Chromium: CVE-2026-11663 Use after free in Skia | 9.6 | 0.0023 | None reported |
| Urgent | CVE-2026-11675 | Chromium: CVE-2026-11675 Insufficient validation of untrusted input in Skia | 9.6 | 0.0021 | None reported |
| Urgent | CVE-2026-11697 | Chromium: CVE-2026-11697 Insufficient validation of untrusted input in UI | 9.6 | 0.0020 | None reported |
| High | CVE-2026-62765 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 8.1 | 0.0043 | Exploitation Less Likely |
| High | CVE-2026-11662 | Chromium: CVE-2026-11662 Type Confusion in Bindings | 8.8 | 0.0036 | None reported |
| High | CVE-2026-11649 | Chromium: CVE-2026-11649 Use after free in V8 | 8.8 | 0.0031 | None reported |
| High | CVE-2026-11650 | Chromium: CVE-2026-11650 Use after free in V8 | 8.8 | 0.0031 | None reported |
| High | CVE-2026-11683 | Chromium: CVE-2026-11683 Use after free in WebCodecs | 8.8 | 0.0031 | None reported |
| High | CVE-2026-11077 | Chromium: CVE-2026-11077 Out of bounds read in Dawn | 8.8 | 0.0028 | None reported |
| High | CVE-2026-11641 | Chromium: CVE-2026-11641 Use after free in Bluetooth | 7.5 | 0.0028 | None reported |
| High | CVE-2026-11643 | Chromium: CVE-2026-11643 Use after free in Proxy | 8.1 | 0.0027 | None reported |
| High | CVE-2026-11629 | Chromium: CVE-2026-11629 Use after free in Ozone | 8.8 | 0.0027 | None reported |
| High | CVE-2026-11632 | Chromium: CVE-2026-11632 Use after free in TabStrip | 7.5 | 0.0026 | None reported |
| High | CVE-2026-11648 | Chromium: CVE-2026-11648 Use after free in FullScreen | 8.8 | 0.0026 | None reported |
| High | CVE-2026-11646 | Chromium: CVE-2026-11646 Use after free in ViewTransitions | 8.8 | 0.0026 | None reported |
| High | CVE-2026-11660 | Chromium: CVE-2026-11660 Insufficient validation of untrusted input in New Tab Page | 8.3 | 0.0026 | None reported |
| High | CVE-2026-11688 | Chromium: CVE-2026-11688 Object lifecycle issue in SVG | 8.8 | 0.0026 | None reported |
| High | CVE-2026-11630 | Chromium: CVE-2026-11630 Use after free in File Input | 8.8 | 0.0025 | None reported |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.