Microsoft Edge Tries to Patch Without a Restart

Microsoft Edge is testing seamless updates that move the browser to a new build while a filled form stays open, with no restart prompt. The demo went up on October 15, 2026. It is not in shipping Edge, and it is not in Chromium.

The pitch is speed. Microsoft’s 2026 Digital Defense Report puts the median time from a bug found in the wild to a working exploit at well below 24 hours, while people still leave a browser open for days rather than lose a tab.

The Patch Gap Now Runs Faster Than a Restart

A fix only protects a PC after it is running on that PC. Microsoft calls the wait between those two points the patch gap, and it says restarts make the wait longer because people freeze an update when they are in the middle of a form, a meeting, or a stack of tabs.

That wait used to look like a few days of caution. The 2026 report, released on October 1, 2026, describes a different clock. Microsoft says AI is compressing attack timelines and speeding up the hunt for flaws, on both sides of the fight.

THE 2026 PATCH CLOCK

• Weaponization: The median time from a vulnerability’s discovery in the wild to a working exploit is well below 24 hours.
• Enterprise repair: Critical bugs on systems that face the internet still take 30 to 60 days to fix in many firms.
• New CVE volume: Nearly 40,000 Common Vulnerabilities and Exposures were published in the first half of 2026.
• Cloud exposure: Exposed cloud workloads were attacked in 5.3 hours on average after they came online.

Microsoft processes 165+ trillion security signals a day, and it is using that pile to argue that a restart prompt is no longer a small annoyance. It is time an attacker can use. The browser is the daily workspace, so a delayed relaunch is a delayed patch on the place most people actually work.

A Prototype That Leaves the Form Open

The Microsoft Edge Blog describes a working prototype that moves the browser to a newer, safer version while open work continues, with no restart prompt and hardly anything to notice. In the story it tells, you are halfway through a long expense form. The receipts are in. Then a security update appears. Restart now, or risk losing the page?

In the prototype, Edge downloads the new version in the background. The browser, its helper processes, and the open tabs then shift to that version while the form stays on screen and the typed data stays put. Microsoft’s illustration shows older tabs keeping their current code only when the two versions can run together, and picking up the new version after the next navigation.

Our goal is that you won’t have to click the update button at all; you would simply continue working with a safer browser. Importantly, your updates could be applied within minutes of availability.

Microsoft Edge Blog, October 15, 2026

The recorded demo still starts with a click on Update, so you can see the handoff. Microsoft says it is sharing the work early to make the aim concrete and to pull other browser makers into the same problem. As of that post, the code is not in production and not in Chromium. There is no public date for a release, and no promise that Chromium will take the design.

Browsers have long needed a restart because they run a mesh of processes that all have to move together without dropping a cart, a draft, or a login. The prototype is an attempt to do that move live. Until it ships, the click, or the idle relaunch, is still the last step.

Edge Already Ships Fixes Ahead of Chrome

Edge is built on Chromium and takes the regular security work of that project. Microsoft says it will not wait on Chromium’s calendar when it decides customers need a fix sooner. That claim is already on the calendar for early September, not only in the October 15 prototype post.

Microsoft Browser Vulnerability Research wrote on October 7, 2026, that Edge Security, Microsoft Threat Intelligence, and the Microsoft Security Response Center had broken up campaigns against Chromium browsers. Attackers were using bugs that had just been fixed, against people still running Edge and Chrome builds that had not taken those fixes. The lab called that patch-gap abuse, and said AI-assisted analysis can squeeze work that once took weeks into hours.

The post says Edge independently isolated and backported the change rather than pulling every unreleased Chromium commit, because the fix had not yet shipped in Chrome Stable. The chain it describes starts with remote code execution in Maglev, one of V8’s optimizing compilers, and then runs code inside V8.

EDGE’S SEPTEMBER LEAD ON CHROME

1. September 2, 2026: Edge Stable 152.0.4191.62 begins to roll out. Microsoft’s security notes say this build includes a fix for CVE-2026-85046, a Chromium bug with an exploit in the wild.
2. September 4, 2026: Edge Stable 152.0.4191.66 follows, with a fix for CVE-2026-87491, also listed as exploited, plus an Edge-only fix, CVE-2026-85892.
3. September 8, 2026: Chrome’s matching Stable update follows, four days after Edge 152.0.4191.66 and six days after the first Edge build.
4. October 7, 2026: Google ships Chrome 155 with 247 security fixes, and Edge’s vulnerability lab publishes the patch-gap post the same date.
5. October 15, 2026: Microsoft shows the seamless-updates prototype and ships Edge Stable 155.0.4283.60, which it says takes in the latest Chromium security updates.

On October 16, 2026, Edge Stable moved again, to 155.0.4283.62, still described as carrying Chromium’s latest security updates. The prototype did not move with it. The extra day of Stable bits is the ordinary Chromium train. The September builds are the part Microsoft can run on its own clock.

Restart to Update on Idle Is the Setting That Exists

What you can turn on now is not a live version swap. It is a timed relaunch. Restart to update on idle, once called Instant Updates, waits until the PC is quiet, restarts Edge, applies a pending update, and puts the tabs back. A restart still happens. It is meant to happen when you are not in the form.

Microsoft says people who usually sit on an update can get the latest protection in hours instead of days with this switch. The feature is off by default. You enable it under Settings, then About Microsoft Edge, or at edge://settings/help, with the toggle labelled Restart to update on idle. Older builds may still say Instant update.

THE IDLE RELAUNCH CLOCK

• First wait: If the device sits unused for 15 minutes and nothing is holding a wake lock, Edge shows a notice that a relaunch is coming.
• Countdown: That notice starts a 5-minute countdown to the restart.
• Floor: If you stay away through that countdown, Edge relaunches. The whole path needs a minimum of 20 minutes of inactivity.

IT teams can set the same behaviour from the Monitoring dashboard in the Edge management service. That is still a restart, moved off the working hour. It is also the only automatic apply path Microsoft is offering to people who will not click Update themselves, until the prototype leaves the lab.

How Admins See Zero-Day Fixes in the Dashboard

For companies that manage Windows devices, Microsoft pointed to Security Update Alerts in the Edge management service, at no extra licensing cost. The October 15 Stable notes for 155.0.4283.60 list those alerts as a feature in that build: admins pick a severity floor and get notices when a new Edge release includes security fixes at or above that floor, including zero-day fixes.

From the Monitoring dashboard, an admin can see each release’s severity, the CVEs it addresses, how many managed Windows devices may still need the update, and the newest builds across Edge channels. They can then tell users to restart, or turn on automatic restarts when devices are idle, from that same screen.

THREE UPDATE PATHS IN EDGE

The dashboard is a map of who is late. It does not apply the bits by itself. Someone still has to restart Edge, or let idle restart do it, before the CVE row on that dashboard becomes protection on the glass.

A 20-Minute Idle Clock Against a Two-Week Cadence

Microsoft’s Edge lifecycle policy puts the browser on a two-week major release cadence from Stable 152, with security and servicing updates only on the latest Stable and the latest Beta. Assisted support covers the current Stable build and the two before it, about six weeks. Extended Stable stays on an eight-week track.

That cadence is why a quiet restart setting matters. A new Edge major can land every two weeks, and Chrome 155’s 247-fix drop shows how large a single Chromium train can be. If the copy on the disk is current but the running browser is two weeks old because nobody closed it, the patch gap is the session, not the download.

Idle restart tries to cut that session down to 20 minutes of an empty desk. Seamless updates try to cut it down to minutes after a build is posted, with the form still open. One of those is a toggle. The other is a prototype Microsoft is using to ask the rest of the browser trade to stop treating a relaunch as the cost of safety.

The invitation in the October 15 post is aimed past Edge users. Microsoft says it wants others in the industry to join the work of moving a browser to a safer version without stopping the person using it. Edge cannot change Chromium’s restart habit by shipping a private demo. It can ship idle restart, ship its own backports, and show a live swap that Chromium does not have.

Microsoft Has Not Named a Ship Date

Microsoft has not said when seamless updates will move from the prototype into a public Edge channel, or whether they will. The October 16 Stable build did not change that. People who want less friction on October 19, 2026, still have the idle toggle and, in managed fleets, the alert dashboard.

The remaining delay is the same one the expense-form story names. A downloaded fix sits on the disk until Edge restarts, unless Microsoft learns to swap the running browser the way the demo claims. Until that swap is in the product, protection still waits on a quiet desk, an admin nudge, or a click.