Vulnerabilities
Chromium CVE-2026-106191: Missing Authorization in Chromium Engine
A missing authorization flaw (CVE-2026-106191) was discovered in the Chromium rendering engine. Microsoft Edge, which incorporates Chromium, is affected until the underlying Chromium update is applied. Defenders should verify Edge version, apply the latest update, and monitor for related exploitation activity.
What happened
A missing authorization check in the Chromium rendering engine (CVE‑2026‑106191) allows an attacker to bypass access controls when loading certain web content. The flaw was identified by Google Chrome and subsequently propagated to all Chromium‑based browsers, including Microsoft Edge.
Impact
Edge users running versions that include the vulnerable Chromium build are susceptible to privilege escalation or unauthorized data access if they load malicious or crafted web pages. The vulnerability does not affect native Windows components directly.
What to do
- Confirm Edge version:
edge://settings/helpormsedge.exe /version. - Apply the latest Edge update; Microsoft releases the patch as part of the Chromium update cycle.
- If immediate update is not possible, restrict execution of untrusted web content in corporate environments and enforce strict content security policies.
- Monitor logs for anomalous page loads or elevated privileges that could indicate exploitation.
Related vulnerabilities
Chromium CVE-2026-106183: Missing Authorization in Edge
A missing authorization check in Chromium’s rendering engine (CVE-2026-106183) can allow attackers to bypass access controls. Microsoft Edge (Chromium-based) inherits this flaw and should be updated immediately. Defenders should verify patch status and monitor for exploitation attempts.
Read briefing
Microsoft Edge (Chromium) Vulnerability CVE-2026-106384: Missing Authorization – Update Required
A missing authorization flaw (CVE-2026-106384) was discovered in Chromium, the engine powering Microsoft Edge. The vulnerability could allow attackers to bypass access controls in Edge and other Chromium-based browsers. Defenders should update to the latest Edge release and verify the patch is applied.
Read briefing
Microsoft Edge (Chromium) Vulnerability CVE-2026-106340: Missing Authorization
A missing authorization flaw (CVE-2026-106340) in Chromium can allow attackers to bypass access controls. Microsoft Edge (Chromium-based) inherits this issue until updated. Defenders should verify Edge version, apply the latest patch, and monitor for suspicious activity.
Read briefing
Microsoft Edge Vulnerability CVE-2026-106199: Incorrect Authorization
A critical authorization flaw (CVE-2026-106199) was discovered in the Chromium engine used by Microsoft Edge. Edge users running outdated versions are at risk of privilege escalation or unauthorized access. Defenders should update to the latest Edge release and monitor for anomalous authorization activity.
Read briefing