A page in Edge can run code. Take 151.0.4129.101

Edge is the browser Windows opens when you click a link in Mail. Microsoft shipped an Edge-specific heap overflow, then folded in this month’s Chromium fixes. A page you visit can run code in the browser. Open About Microsoft Edge, wait for 151.0.4129.101 on the desktop, and restart. The phone wants 151.0.4129.86 or newer.

Overview

What broke

On 14 August 2026 Microsoft released Edge 151.0.4129.86 with an Edge-specific fix, CVE-2026-72970. Microsoft describes a heap-based buffer overflow that lets an unauthorized attacker execute code over a network. In English, a crafted page can write past a chunk of memory Edge allocated and take over that process. Microsoft rated it High, 8.3. The score includes user interaction. You have to visit or open the content. It is not a drive-by from a closed laptop.

A heap overflow is a cousin of the Zoom bounds-check story. Edge asks the system for a block of memory (the heap), then writes into it. If the write is longer than the block, the extra bytes land on whatever sat next door. Those extra bytes can become instructions. The page that delivers them looks like a page. That is why a High browser bug is never “just a tab.”

The 14 August 86 build is also the first desktop train that carries this Edge-specific CVE. Android and iOS received 151.0.4129.86 on 17 August. On 20 August Microsoft released desktop 151.0.4129.101, which incorporates the latest Chromium security updates. Take 101 on the desktop. Do not stop at last week’s 86 if About Edge will still move. Microsoft’s Edge security release notes are the version list. The MSRC page for 72970 is the CVE card.

Microsoft has not said 72970 is being used in the wild. CISA has not listed it on KEV. The notes for 101 do not add a second Edge-specific CVE. They fold Chromium’s latest security work into the same About screen. One restart covers both layers.

Who is in range

Anyone who still launches Edge on Windows, Mac, or Linux below 151.0.4129.101, or on Android or iOS below 151.0.4129.86. If you “don’t use Edge” but never uninstalled it, Windows still opens it from Mail, Start, some store links, and the widgets pane. That copy is in range. A shop PC with Edge pinned as the company browser is in range until About shows 101.

Chrome-only households still have an Edge binary on most Windows machines. Updating Chrome does not patch Edge. They share Chromium guts. They do not share the installer. Firefox and Safari are separate clicks and separate briefs.

A leftover Dev, Beta, or Canary shortcut is a different binary. Open that copy and read its own About line. Stable 101 does not patch a channel you installed for testing and then forgot. A portable Edge copied into a folder is the same story: its About page is the only proof.

What the vendor shipped

• Desktop Stable: 151.0.4129.101 (20 August 2026), the build to take today
• Desktop Stable 151.0.4129.86 (14 August 2026), the first build with the Edge-specific CVE fix
• Android and iOS: 151.0.4129.86 (17 August 2026)

The in-app path is three dots, Help and feedback, About Microsoft Edge. Edge downloads the build itself. You wait, then Restart. Phone builds come from the App Store or Google Play. A shop image managed by Intune will not self-update until whoever owns the image allows 151.

What this is not

• Not patched by updating Chrome. Same engine family, different installer.
• Not a closed-laptop attack. Microsoft’s score includes user interaction. A visit or an open is the click.
• Not on CISA KEV. Microsoft has not said 72970 is in the wild.
• Not done if About Edge still reads 151.0.4129.86 on the desktop. 86 closed the Edge-specific CVE. 101 is the current desktop security build.

The patch is out. About Edge is already in the menu. That is the cheap window. You do not need a second installer or a Windows reboot. The browser fetches the bits, then asks for a Restart of Edge only. If you close the About tab before it finishes, open it again. It will resume.

Who can skip

• About Microsoft Edge already shows 151.0.4129.101 or newer on the desktop.
• Phone already shows 151.0.4129.86 or newer, and you have no desktop Edge that anyone clicks.
• Chrome-only, and you have confirmed Edge is not the handler for Mail or Start links, skip this tab. Take the Chrome brief instead.
• A shop PC whose Edge is frozen by policy cannot self-update. That is an IT push of 101, not a skip for the fleet.

Why it matters

Edge holds the session you already logged into: mail, the bank tab, the password door, the shop’s admin console. A heap overflow in the browser is how a nasty page stops being a tab and starts being the process. You do not need a second exploit story for that to be worth a restart.

Windows makes this easy to ignore. People who “don’t use Edge” still have it. Mail opens it. A Teams meeting link opens it. The first-run splash you dismissed last year did not uninstall the browser. Microsoft did not put an exploited flag on this CVE. CISA has not added it to KEV. Waiting is still how a High bug sits on the default Windows browser for a week while you keep clicking through Mail.

The Chromium layer is the other half. 101 is not a cosmetic point-release. It is the build Microsoft used to pull in the latest Chromium security updates. Taking 86 last Friday and stopping there leaves that second pile on the desk. One About screen, one Restart, both layers.

A shop that images PCs once a quarter is the other half of in range. The front-desk machine, the loaner laptop, the kiosk that only opens a booking page: those launch Edge whether anyone says they use a browser or not. Today is the click. The About page is already in the three-dot menu.

The bottom line

On the PC

1. Open Microsoft Edge. Any tab is fine. You do not need a special page.
2. Click the three dots in the top right. That menu is Settings and more on some builds.
3. Click Help and feedback, then About Microsoft Edge. The About page is a real Edge tab. It will say Microsoft Edge and a version number, then start checking.
4. Let it download. The line you want on desktop is 151.0.4129.101 or a later 151 build. If it still shows 151.0.4129.86, stay on the page until 101 arrives.
5. Click Restart when the button appears. Edge will close every window and reopen them. That is expected. If there is no Restart button and the number is already 151.0.4129.101, you are done on this PC.
6. Open About one more time after the restart and read the number. Do not trust the splash. Trust the About line.
7. If a second person uses this PC under their own Windows login, switch user once, open About, and confirm the same 101 line. The bits are usually already there. The restart is what loads them in that session.

If About Edge never moves

Quit Edge fully. On Windows, click the Edge icon in the system tray or use Task Manager and end the Microsoft Edge processes, then reopen Edge and try About again. A download that sits at 0% is often a store or proxy block. Use the network you already trust. Do not download Edge from a random “browser update” site. Microsoft’s own About page is the installer.

A shop PC with Edge managed by Intune, Group Policy, or a “do not update” catalog will not self-update no matter how many times you open About. Ask whoever owns the image to push 151.0.4129.101. That is the same build. It is just delivered by the shop’s tool instead of the three-dot menu.

On the phone and the other PC

1. iPhone: App Store, your picture, Microsoft Edge, Update. Swipe the app away and open it once.
2. Android: Google Play, Microsoft Edge, Update. Force-close the app and open it. About should show 151.0.4129.86 or newer.
3. The laptop in the bag, the shop front-desk PC, the machine that only opens Mail: same three-dot path tonight. One stale Edge is enough.

What you should see

On the About tab, under the Microsoft Edge heading, the version is a four-part number. 151 is the major. 0.4129 is the Chromium train Microsoft is on this month. 101 is the security build from 20 August. If you still see 78, 86, or 59 in that last slot on the desktop, you are not on 101. Stay on the page. The blue progress bar is the download. The Restart button is the close. After Restart, the same About tab should show the new number without asking again.

When you are done

Desktop About reads 151.0.4129.101 or newer. Phone About reads 151.0.4129.86 or newer. Both have been restarted or force-closed once. Chrome and Firefox are separate clicks. This tab only closes Edge. You do not need to clear history or sign out of anything. You needed a new build. You have it.