Skip to content
OpenAdvisories
High MSRC-CVE-2025-25000 1 CVE

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Published Apr 3, 2025 · Updated Apr 18, 2025 · Revision 2

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What is the version information for this release?
135.0.3179.54: 135.0.3179.54, 4/3/2025: 4/3/2025, 135.0.7049.41/.42/.52: 135.0.7049.41/.42/.52

How could an attacker exploit this vulnerability via the Network?
An attacker could host a specially crafted website designed to exploit the vulnerability through Microsoft Edge and then convince a user to view the website. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action, typically by an enticement in an email or instant message, or by getting the user to open an attachment sent through email.

Security updates
135.0.3179.54 — https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security

Vulnerabilities 1

  • High 8.8
    CVE-2025-25000

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

    Microsoft Microsoft Edge (Chromium-based) Browsers

Revision history

  1. #2

    Corrected Build Number in the Security Updates table. This is an informational change only.

  2. #1

    Information published.

References