HKCERT, the computer emergency response team in Hong Kong, published a security bulletin on 20 October 2026. It says Microsoft Edge has multiple vulnerabilities. The bulletin names two affected builds: Edge before version 155.0.4283.62, and Edge for Android before version 155.0.4283.61. It links to more than 100 Microsoft entries, each with its own CVE number (a public ID for one flaw). It also points to Microsoft's Edge security release notes dated 16 and 19 October 2026.
HKCERT says a remote attacker could use some of the flaws against a target system. The harms it lists include cross-site scripting, denial of service, elevation of privilege, bypassing security limits, leaking sensitive data, remote code execution, data tampering and spoofing. The bulletin does not say which flaw causes which harm. It gives no severity ratings and does not say whether any flaw is under attack. For Android, it tells users to update to 155.0.4283.61 or later. It names no matching fix version for other platforms. It also tells readers to check the vendor's website for more details.
Edge is a browser that staff and customers use every day, so a long list of flaws affects many machines. IT teams can check which Edge builds they run against the two versions HKCERT names. They can then read Microsoft's release notes for the fix details.