Vulnerabilities
Chromium CVE‑2026‑106291: Use‑After‑Free Vulnerability Affects Edge Chromium
A use‑after‑free flaw in Chromium (CVE‑2026‑106291) can allow attackers to execute arbitrary code. Microsoft Edge (Chromium‑based) inherits this issue, requiring immediate patching. Defenders should verify Edge is updated to the latest release and monitor for anomalous activity.
Microsoft Edge (Chromium‑based) now contains a use‑after‑free flaw discovered in the Chromium engine (CVE‑2026‑106291). The bug allows an attacker to trigger a memory corruption during page rendering, potentially leading to arbitrary code execution.
Impact
- Remote code execution on the client machine.
- Potential privilege escalation if the browser runs with elevated rights.
- Can be exploited via malicious web content or phishing sites.
Defender Actions
- Ensure Edge is updated to the latest version (check the release notes for CVE‑2026‑106291).
- Apply the corresponding Chromium patch as soon as it is available.
- Enable automatic browser updates to reduce exposure time.
- Monitor endpoint logs for anomalous process creation or memory access patterns.
- Consider disabling or restricting JavaScript execution on untrusted sites if policy allows.
Mitigation Status
The Chromium project has released a patch; Microsoft has incorporated it into the next Edge release. Until the patch is applied, the vulnerability remains exploitable.
Related vulnerabilities
Chromium CVE‑2026‑95356: Use‑After‑Free in WindowDialog
A use‑after‑free flaw in Chromium’s WindowDialog component (CVE‑2026‑95356) can enable arbitrary code execution via malicious web content. Microsoft Edge, which incorporates Chromium, is affected until the patch is applied. Defenders should update to the latest Edge release and monitor for anomalous browser activity.
Read briefing
Microsoft Edge (Chromium) – CVE-2026-95319 Use-After-Free in Printing
A use‑after‑free flaw in the Chromium printing engine (CVE‑2026‑95319) can allow local code execution on systems running Microsoft Edge. The issue is already fixed in the latest Chromium releases. Edge users should update immediately and consider disabling printing until a patch is applied.
Read briefing
Chromium CVE‑2026‑95325: Use‑After‑Free in ANGLE Affects Microsoft Edge
A use‑after‑free flaw in Chromium’s ANGLE graphics layer (CVE‑2026‑95325) can lead to arbitrary code execution in Microsoft Edge (Chromium‑based). The issue is fixed in the latest Edge releases. Defenders should verify their Edge version and apply the update immediately.
Read briefing
Microsoft Edge Addresses Chromium CVE-2026-95313 Use‑After‑Free in Fullscreen
A use‑after‑free flaw (CVE‑2026‑95313) was found in Chromium’s fullscreen handling. Microsoft Edge, built on Chromium, has incorporated the patch. Defenders should verify that Edge is updated to the latest release and monitor for any anomalous fullscreen activity.
Read briefing