Vulnerabilities
Chromium CVE-2026-106338: UI Misrepresentation in Edge – Update Required
Microsoft Edge users may be exposed to a UI misrepresentation flaw (CVE‑2026‑106338) that can allow attackers to spoof interface elements. The issue originates from Chromium and is fixed in the latest Edge releases. Defenders should verify Edge versions, apply the update, and monitor for anomalous UI behavior.
What Happened
Chromium introduced a flaw that can cause UI elements to be rendered incorrectly, potentially enabling UI spoofing. The flaw is identified as CVE‑2026‑106338.
Who Is Affected
All users of Microsoft Edge (Chromium‑based) running versions prior to the latest security update are vulnerable. The issue is tied to the Chromium engine that Edge incorporates.
Impact
Attackers could manipulate the appearance of browser UI, leading to phishing or credential theft. The vulnerability does not allow direct code execution but can mislead users into interacting with malicious content.
What to Do
- Check current Edge version: edge://settings/help.
- If version is older than the latest, download the latest update from Microsoft Update or the Edge installer.
- Verify that the update includes the Chromium patch for CVE‑2026‑106338.
- Enable automatic updates to prevent re‑exposure.
- Monitor for any anomalous UI rendering in logs or user reports.
Reference
See Google Chrome releases for details on the Chromium patch: https://chromereleases.googleblog.com/2026
Related vulnerabilities
Multiple Vulnerabilities Discovered in Microsoft Edge – Immediate Patch Required
Microsoft Edge has 30+ CVEs that can lead to arbitrary code execution and privilege escalation. All supported Edge releases are affected. Defenders must update immediately and harden browser settings.
Read briefing
CVE-2026-70190: .NET Elevation of Privilege Vulnerability – No New Fix Required
CVE‑2026‑70190 is an elevation‑of‑privilege flaw in .NET 11.0 that was already addressed in earlier releases. Microsoft has updated its Security Updates table to include KB article links for .NET 11.0 and Visual Studio, but the fixed builds remain unchanged. Defenders should confirm that their systems run the latest patched .NET 11.0 and Visual Studio versions and apply any pending KB updates.
Read briefing
Multiple Privilege‑Escalation Vulnerabilities in Microsoft Edge (CVE‑2026‑91708‑91729)
Microsoft Edge contains a series of 22 CVEs that allow attackers to elevate privileges and trigger an unspecified security issue. Systems running the 21 September 2026 build are affected. Immediate patching and monitoring are required.
Read briefing
CVE-2026-105591: Microsoft Office Access Remote Code Execution Vulnerability
A heap-based buffer overflow in Microsoft Office Access allows an unauthenticated attacker to execute arbitrary code over the network via a crafted database file. Microsoft has released a patch; defenders should update immediately and restrict network exposure of Access.
Read briefing