Vulnerabilities
Chromium Bluetooth Use-After-Free CVE-2026-95348 – Edge Update Required
A use‑after‑free flaw in Chromium’s Bluetooth stack (CVE-2026-95348) can lead to arbitrary code execution. Microsoft Edge, which incorporates Chromium, is affected. Defenders should verify they are running the latest Edge build and apply any pending updates.
A recent Chromium bug, identified as CVE-2026-95348, exploits a use‑after‑free condition in the Bluetooth subsystem. The flaw could allow a malicious device to trigger memory corruption and potentially execute code with the privileges of the browser process.
Impact
Microsoft Edge (Chromium‑based) inherits the vulnerability through its Chromium core. Any user who accepts connections from untrusted Bluetooth devices is at risk.
Mitigation
- Ensure Edge is updated to the latest version; the Chromium team has already released a patch.
- Disable Bluetooth in Edge or block device pairing when not needed.
- Monitor for anomalous network or process activity that may indicate exploitation.
What to Do
Apply the newest Edge update immediately. Verify that the update includes the Chromium security fix. If you cannot update, consider temporarily disabling Bluetooth or restricting device pairing.
Related vulnerabilities
Chromium CVE‑2026‑95325: Use‑After‑Free in ANGLE Affects Microsoft Edge
A use‑after‑free flaw in Chromium’s ANGLE graphics layer (CVE‑2026‑95325) can lead to arbitrary code execution in Microsoft Edge (Chromium‑based). The issue is fixed in the latest Edge releases. Defenders should verify their Edge version and apply the update immediately.
Read briefing
Microsoft Edge (Chromium) – CVE-2026-95319 Use-After-Free in Printing
A use‑after‑free flaw in the Chromium printing engine (CVE‑2026‑95319) can allow local code execution on systems running Microsoft Edge. The issue is already fixed in the latest Chromium releases. Edge users should update immediately and consider disabling printing until a patch is applied.
Read briefing
Chromium CVE-2026-87455: Use‑after‑free in Aura Affects Microsoft Edge
A use‑after‑free flaw in Chromium’s Aura layer (CVE‑2026‑87455) can allow arbitrary code execution. Microsoft Edge, built on Chromium, inherits the issue and is fixed in the latest releases. Defenders should update Edge and monitor for patches.
Read briefing
Chromium CVE‑2026‑95356: Use‑After‑Free in WindowDialog
A use‑after‑free flaw in Chromium’s WindowDialog component (CVE‑2026‑95356) can enable arbitrary code execution via malicious web content. Microsoft Edge, which incorporates Chromium, is affected until the patch is applied. Defenders should update to the latest Edge release and monitor for anomalous browser activity.
Read briefing