Vulnerabilities
Chromium CVE-2026-106365: Missing Authorization – Edge and Chrome Update Required
A missing authorization flaw (CVE‑2026‑106365) was found in Chromium, potentially enabling unauthorized access to privileged operations. Microsoft Edge (Chromium‑based) and Google Chrome are affected. Defenders should confirm browsers are updated to the latest release that contains the fix.
What Happened
A missing authorization vulnerability (CVE‑2026‑106365) was identified in the Chromium engine. The flaw could allow an attacker to perform privileged actions without proper authorization checks.
Impact
Microsoft Edge (Chromium‑based) and Google Chrome are directly affected because they incorporate the vulnerable Chromium code. Exploitation could lead to unauthorized data access or manipulation within the browser context.
Mitigation
Both Microsoft and Google have released patches in the latest browser updates. The fix removes the missing authorization checks and restores proper access controls.
Recommended Actions
- Verify that Microsoft Edge is at the latest version (currently 125.x or newer).
- Verify that Google Chrome is at the latest version (currently 125.x or newer).
- Deploy the updates across all managed endpoints using your standard patch management workflow.
- Monitor for any anomalous activity that could indicate exploitation attempts.
Related vulnerabilities
Microsoft Edge (Chromium) Vulnerability CVE-2026-106384: Missing Authorization – Update Required
A missing authorization flaw (CVE-2026-106384) was discovered in Chromium, the engine powering Microsoft Edge. The vulnerability could allow attackers to bypass access controls in Edge and other Chromium-based browsers. Defenders should update to the latest Edge release and verify the patch is applied.
Read briefing
Chromium CVE-2026-106191: Missing Authorization in Chromium Engine
A missing authorization flaw (CVE-2026-106191) was discovered in the Chromium rendering engine. Microsoft Edge, which incorporates Chromium, is affected until the underlying Chromium update is applied. Defenders should verify Edge version, apply the latest update, and monitor for related exploitation activity.
Read briefing
Chromium CVE-2026-95296: Missing authorization in Core; update Chrome and Edge
Chromium CVE-2026-95296 reports a missing authorization issue in Core, with Microsoft Edge expected to inherit the fix through Chromium updates. Public details are limited, so defenders should deploy current Chrome and Edge stable releases and verify update channels. Custom Chromium-based applications should be checked for delayed patching.
Read briefing
Microsoft Edge (Chromium) Vulnerability CVE-2026-106340: Missing Authorization
A missing authorization flaw (CVE-2026-106340) in Chromium can allow attackers to bypass access controls. Microsoft Edge (Chromium-based) inherits this issue until updated. Defenders should verify Edge version, apply the latest patch, and monitor for suspicious activity.
Read briefing