Advisories
Chromium CVE-2026-106418: Missing Authorization in Edge and Chrome
A missing authorization flaw (CVE‑2026‑106418) was discovered in Chromium, affecting all Chromium‑based browsers including Microsoft Edge. The issue is fixed in the latest releases; defenders should verify that their browsers are up‑to‑date and monitor for any anomalous access attempts.
Microsoft Edge (Chromium‑based) and Google Chrome are affected by CVE‑2026‑106418, a missing authorization flaw that could allow an attacker to gain unauthorized access to privileged functions within the browser engine.
What happened
The vulnerability was identified in the Chromium project and assigned a CVE number by Google. The flaw allows bypassing authorization checks for certain internal APIs.
Impact
- Potential unauthorized execution of privileged browser code.
- Risk of privilege escalation within the browser context.
What to do
- Verify that your browsers are running the latest stable release (Edge 125+ or Chrome 125+).
- Apply any pending updates immediately; the patch is included in the most recent Chromium builds.
- Check the version string (e.g., "Chromium 125.0.6422.114") to confirm the update.
- Monitor browser logs for anomalous API calls that could indicate exploitation attempts.
Edge users should also review the release notes for the latest security updates to ensure the patch is applied.
Related vulnerabilities
Chromium CVE-2026-95296: Missing authorization in Core; update Chrome and Edge
Chromium CVE-2026-95296 reports a missing authorization issue in Core, with Microsoft Edge expected to inherit the fix through Chromium updates. Public details are limited, so defenders should deploy current Chrome and Edge stable releases and verify update channels. Custom Chromium-based applications should be checked for delayed patching.
Read briefing
Microsoft Edge Addresses Chromium Safe Browsing Authorization Flaw (CVE-2026-95292)
A recent Chromium vulnerability (CVE-2026-95292) exposed incorrect authorization handling in Safe Browsing. Microsoft Edge, built on Chromium, has incorporated the fix. Update Edge to mitigate the risk.
Read briefing
Chromium Contextual Tasks authorization flaw (CVE-2026-95297) affects Chromium-based browsers
Chromium has assigned CVE-2026-95297 for a missing authorization issue in Contextual Tasks. The advisory indicates the fix is being addressed in Chromium and will be ingested by Chromium-based products such as Microsoft Edge. Defenders should deploy current stable browser builds, verify deployed versions, and monitor vendor release notes for exact version ranges and severity.
Read briefing
Microsoft Edge Fixes Chromium CVE-2026-95287: Missing Authorization in Navigation
A missing authorization check in Chromium’s navigation handling (CVE‑2026‑95287) could allow attackers to force the browser to navigate to arbitrary URLs without user consent. Microsoft Edge, built on Chromium, has incorporated the fix. Update to the latest Edge release to mitigate.
Read briefing