Microsoft’s November desktop Edge updates have two separate patch milestones. Check the release channel and the running build before closing the ticket.
What changed November 12, 2026
If you verified the November 5 build on an admin workstation, check it again. Microsoft’s Edge enterprise release feed now gives us a desktop patch target for CVE-2026-125350 and CVE-2026-125346. It maps both to Edge Stable 157.0.4341.46, with November 10 package timestamps for Windows x86, x64 and Arm64, macOS universal, and Linux x64. Microsoft’s package URLs responded for all five platform and architecture rows.
Both are Chromium XML use-after-free issues. The affected browser must process untrusted web content. CISA describes potential code execution inside the browser sandbox for CVE-2026-125350. Google rates both High and reports in-the-wild exploitation of CVE-2026-125350. CISA’s CVSS 3.1 assessment for that CVE is 8.8 and requires user interaction. CISA added it to KEV November 10 with a November 24 federal deadline. CVE-2026-125346 is absent from KEV. Microsoft’s feed labels the release 0-Day. Edge-specific exploitation, exploitation of CVE-2026-125346 and a separate Edge CVSS score remain unverified.
Suggested MSP priority. Expedite standard Stable updates, starting with technician and privileged browser workstations. Check the channel and running build, update to 157.0.4341.46 or a newer supported Stable release, relaunch and confirm the build and customer portal access. If rollout must wait on a privileged workstation, use a patched browser for customer administration. Microsoft’s feed does not supply the full affected range, a workaround, a credential-rotation requirement or a fixed mapping for Extended Stable, iOS or WebView2. Keep those checks open against their own guidance.
The Microsoft Edge enterprise feed supplies the desktop mapping. Microsoft’s Stable release notes still show the November 5 build, and its security notes explicitly document the separate Android fix. See Google’s Chromium disclosure, the CVE record and CISA score, and CISA’s KEV data. Last verified November 12, 2026 UTC.
November 5 release and November 11 CVE mapping
Microsoft’s November 5 Edge Stable release shipped while the CVE list was pending. The November 11, 2026 MSRC feed now maps 54 Chromium CVEs to 157.0.4341.42, including seven entries with scores of 9.6.
The MSRC rows give initial advisory dates of November 5 or November 11. The 9.6 scores are CVSS 3.1 values for the underlying Chromium issues, including authorization and memory-safety flaws. The records assign no separate Edge severity and do not report exploitation of these 54 entries. None of the 54 appears in the checked CISA KEV catalog.
Suggested MSP priority The November 5 build is the historical fix for the 54 CVEs below. Use the current patch target above for desktop Stable rollout. Last verified November 12, 2026 UTC.
Applicability and verification
Microsoft’s CVRF identifies Edge Chromium-based and lists 157.0.4341.42 as fixed for every CVE below. Check the desktop Stable channel and running build, then install the current supported Stable update and relaunch Edge. Verify the version on the endpoint and confirm customer portal access. The source does not give an affected lower build boundary, a complete platform matrix, or separate fix mappings for Extended Stable or WebView2. Check those channels and runtimes against their own vendor guidance.
The earlier 54-CVE mapping covers the November 5 release. Use the newer desktop Stable build above for CVE-2026-125350 and CVE-2026-125346.
CVE references
CVE-2026-121040, CVE-2026-121041, CVE-2026-121043, CVE-2026-121044, CVE-2026-121045, CVE-2026-121046, CVE-2026-121047, CVE-2026-121048, CVE-2026-121049, CVE-2026-121052, CVE-2026-121053, CVE-2026-121054, CVE-2026-121055, CVE-2026-121057, CVE-2026-121059, CVE-2026-121060, CVE-2026-121061, CVE-2026-121062, CVE-2026-121063, CVE-2026-121064, CVE-2026-121065, CVE-2026-121066, CVE-2026-121067, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121072, CVE-2026-121073, CVE-2026-121075, CVE-2026-121076, CVE-2026-121077, CVE-2026-121140, CVE-2026-121141, CVE-2026-121142, CVE-2026-121143, CVE-2026-121148, CVE-2026-121156, CVE-2026-121157, CVE-2026-121158, CVE-2026-121159, CVE-2026-121160, CVE-2026-121161, CVE-2026-121162, CVE-2026-121163, CVE-2026-121164, CVE-2026-121165, CVE-2026-121166, CVE-2026-121167, CVE-2026-121168, CVE-2026-121169, CVE-2026-121170, CVE-2026-121171, CVE-2026-121172
MSRC November CVRF · Edge Stable release notes · Microsoft Edge security notes · CISA KEV