Vulnerabilities
Chromium CVE-2026-106299 Improper Input Validation Affects Edge and Other Chromium Browsers
An improper input validation flaw in Chromium (CVE-2026-106299) can be exploited by attackers to potentially execute arbitrary code or perform malicious actions in browsers that use the affected engine. Microsoft Edge and other Chromium‑based browsers are impacted. Defenders should verify the browser version and apply the latest security update immediately.
What Happened
Chromium introduced a flaw in its input validation logic (CVE-2026-106299) that allows an attacker to supply crafted input to the browser engine. The vulnerability is triggered when the browser parses certain data types, potentially leading to code execution or other malicious behavior.
Impact
All Chromium‑based browsers that have not applied the latest patch are vulnerable. This includes Microsoft Edge, Google Chrome, and other derivatives. The flaw can be leveraged to run arbitrary code in the context of the browser or to bypass security boundaries.
Detection
Check the browser version. The vulnerability was fixed in Chromium 124.0.6367.0 and Edge 124.0.2410.0. If you are running an older build, you are exposed.
Mitigation
- Update to the latest Chromium or Edge release.
- Configure browsers to block untrusted content and enforce strict input validation.
- Deploy automated patch management to ensure timely updates across endpoints.
Microsoft Edge automatically receives the Chromium patch through its update channel, so ensure that automatic updates are enabled.
Related vulnerabilities
Chromium CVE-2026-95364: Improper Password Input Validation Fixed in Edge
A flaw in Chromium’s password handling allowed improper input validation, potentially exposing credentials. Microsoft Edge (Chromium‑based) incorporates the fix. Defenders should verify Edge is updated to the latest version and monitor for credential leakage.
Read briefing
Chromium CVE‑2026‑95365: Type Confusion in IndexedDB Fixed in Edge
A type‑confusion flaw in Chromium’s IndexedDB (CVE‑2026‑95365) affects Microsoft Edge and other Chromium‑based browsers. Defenders should update to the latest Edge release or disable IndexedDB on untrusted sites to mitigate exploitation.
Read briefing
Microsoft Edge Vulnerability CVE-2026-95370: NFC Implementation Flaw
A flaw in Chromium’s NFC handling (CVE‑2026‑95370) can allow attackers to exploit improper data validation. Microsoft Edge, built on Chromium, inherits the issue. Defenders should verify Edge is updated to the latest release and consider disabling NFC features if not required.
Read briefing
Microsoft Edge Patch for CVE‑2026‑95375: BrowserTag Authorization Flaw
A Chromium BrowserTag authorization flaw (CVE‑2026‑95375) affects all Chromium‑based browsers. Microsoft Edge will receive the fix via its standard update channel. Defenders should update immediately and verify the patch.
Read briefing