Should you update to Microsoft Edge 154.0.4258.37?
No: install Microsoft Edge 156.0.4314.58 instead. Microsoft Edge 154.0.4258.37 is a security update Microsoft released on 24 Sep 2026 for Mac and Windows. It fixes 114 security flaws, 12 rated critical and 31 important by Microsoft.[1] None of them is known to be used in attacks.
It has since been replaced by Microsoft Edge 154.0.4258.48, released 29 Sep 2026, which includes all of its fixes. If you’re on an older version, install that instead.
Should you update?
No: install Microsoft Edge 156.0.4314.58 instead. Microsoft Edge 156.0.4314.58 came out on 30 Oct 2026 and includes every fix in Microsoft Edge 154.0.4258.37, so there’s no reason to stop at this one. Software Update offers the newest version your device can run.
Is Microsoft Edge 154.0.4258.37 still safe?
Not any more. The 12 updates since, up to Microsoft Edge 156.0.4314.58, fix 751 security flaws that Microsoft Edge 154.0.4258.37 doesn’t, and each became public the day its fix shipped. Installing it is safe: get it only from Edge’s own About page (Edge updates itself; there’s nothing to download from a website), never from a link in an email, text or pop-up.
What it fixes
Microsoft lists 114 security flaws, 12 rated critical and 31 important by Microsoft.[1] The 43 critical and important ones are:
| Flaw | Severity | What Microsoft calls it |
|---|---|---|
CVE-2026-95281 | Critical | Chromium CVE-2026-95281: Buffer overflow in ANGLE |
CVE-2026-95284 | Critical | Chromium CVE-2026-95284: Buffer overflow in ANGLE |
CVE-2026-95310 | Critical | Chromium CVE-2026-95310: Use after free in AdFilter |
CVE-2026-95313 | Critical | Chromium CVE-2026-95313: Use after free in Fullscreen |
CVE-2026-95322 | Critical | Chromium CVE-2026-95322: Out of bounds write in GPU |
CVE-2026-95329 | Critical | Chromium CVE-2026-95329: Out of bounds write in WebGL |
CVE-2026-95339 | Critical | Chromium CVE-2026-95339: Use after free in ServiceWorker |
CVE-2026-95349 | Critical | Chromium CVE-2026-95349: Buffer overflow in WebGL |
CVE-2026-95350 | Critical | Chromium CVE-2026-95350: Buffer overflow in ANGLE |
CVE-2026-95356 | Critical | Chromium CVE-2026-95356: Use after free in WindowDialog |
CVE-2026-95357 | Critical | Chromium CVE-2026-95357: Out of bounds write in GPU |
CVE-2026-96202 | Critical | Windows Raw Image Extension Remote Code Execution Vulnerability |
CVE-2026-85890 | Important | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2026-85897 | Important | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2026-95274 | Important | Chromium CVE-2026-95274: Improper output encoding in DevTools |
CVE-2026-95277 | Important | Chromium CVE-2026-95277: Use after free in Views |
CVE-2026-95280 | Important | Chromium CVE-2026-95280: Race condition in V8 |
CVE-2026-95282 | Important | Chromium CVE-2026-95282: Use after free in Platform |
CVE-2026-95283 | Important | Chromium CVE-2026-95283: Buffer overflow in Tint |
CVE-2026-95286 | Important | Chromium CVE-2026-95286: Type confusion in Bindings |
CVE-2026-95291 | Important | Chromium CVE-2026-95291: UI misrepresentation in SecurityIndicators |
CVE-2026-95293 | Important | Chromium CVE-2026-95293: Uninitialized resource in GPU |
CVE-2026-95298 | Important | Chromium CVE-2026-95298: Use after free in Browser |
CVE-2026-95299 | Important | Chromium CVE-2026-95299: Use after free in GPU |
CVE-2026-95301 | Important | Chromium CVE-2026-95301: Missing authorization in Extensions |
CVE-2026-95304 | Important | Chromium CVE-2026-95304: Out of bounds write in V8 |
CVE-2026-95306 | Important | Chromium CVE-2026-95306: Type confusion in V8 |
CVE-2026-95311 | Important | Chromium CVE-2026-95311: Free of non-heap memory in Fonts |
CVE-2026-95315 | Important | Chromium CVE-2026-95315: Use after free in Aura |
CVE-2026-95318 | Important | Chromium CVE-2026-95318: Buffer overflow in Video |
| and 13 more | ||
How to update, and how long it takes
A minute or two. Edge restarts and reopens your tabs.
- Open Edge and click the three dots (…) at the top right.Choose Help and feedback, then About Microsoft Edge.
- Let it download the update.Edge checks as soon as that page opens. When it’s done, click Restart.
To check it worked: Three dots (…) → Help and feedback → About Microsoft Edge: the version is under the name, e.g. 157.0.4341.42. It should say 154.0.4258.48 or later.
153.0.4234.49 vs 154.0.4258.37
Microsoft Edge 153.0.4234.49, released 21 Sep 2026, fixed 1 security flaw. Microsoft Edge 154.0.4258.37 fixes 114 security flaws and includes the fixes before it, so going straight to 154.0.4258.37 gets you both.
- Before: Microsoft Edge 153.0.4234.49, 21 Sep 2026, 1 security flaw
- After: Microsoft Edge 154.0.4258.48, 29 Sep 2026, 2 security flaws
- Microsoft Edge updates, every release and the latest version
- Updates, the latest version of everything HARD tracks
References
- ^ Microsoft. “Microsoft Edge security release notes, September 24, 2026”, 24 Sep 2026.