If your technicians use Edge on Android to reach customer portals, check the app version in the work profile. Microsoft confirmed on November 11, 2026 that Edge for Android build 157.0.4341.53 fixes CVE-2026-125350.
What changed
Microsoft’s November 9 note said a fix was in progress. The November 11 release identifies the fixed Android build and cites Chromium’s report of exploitation in the wild. The underlying XML use-after-free can allow code execution inside the browser sandbox if a user opens a crafted page.
Severity Google rates the Chromium flaw High. CISA’s CVE enrichment scores the underlying flaw 8.8 (CVSS 3.1). Microsoft’s Android note gives no separate rating. Suggested MSP priority Urgent on managed Android devices that use Edge for customer administration. Last verified November 12, 2026 UTC.
CISA added CVE-2026-125350 to KEV on November 10, 2026. The November 24, 2026 due date is a U.S. federal deadline.
Which devices to check
Inventory Edge for Android and flag builds below 157.0.4341.53 for update. Microsoft identifies the fixed build and gives no complete affected-version matrix. Desktop Edge, Edge for iOS, and WebView2 require separate CVE-specific confirmation. No Edge-specific workaround or vendor-directed compromise checks or credential rotation were verified.
What to do across customers
- Inventory the installed Edge app and version across managed Android devices and work profiles. Start with devices used for privileged Microsoft 365, Entra, Intune or RMM access.
- If compromise is suspected, follow the customer’s incident response process. Isolate the device where supported, preserve evidence, and review associated endpoint and privileged sign-in activity.
- Roll out the updated app through Managed Google Play for Intune-managed Android Enterprise devices, or the applicable Google Play channel. Relaunch Edge and verify the installed build in the relevant profile. Track devices below the fixed build or missing from inventory until verified.