Chromium CVE‑2026‑95303: Incomplete Cleanup in SmartCard Component

A recent CVE (CVE‑2026‑95303) was identified in the SmartCard implementation within Chromium. The flaw stems from incomplete cleanup of resources after SmartCard operations, which could allow an attacker to trigger unintended behavior or resource exhaustion.

What happened

The SmartCard module fails to fully release allocated memory or handles after use. This oversight can lead to memory corruption or denial‑of‑service conditions when an attacker crafts malicious SmartCard interactions.

Impact

• All Chromium‑based browsers, including Microsoft Edge, are affected until the next patch.
• Potential for local privilege escalation or denial‑of‑service on systems using SmartCard authentication.

Mitigation

• Ensure browsers are updated to the latest Chromium release that contains the SmartCard fix.
• For Edge users, install the most recent Edge update.
• Disable SmartCard authentication on systems that do not require it, if immediate update is not possible.

Monitoring

Watch for unusual SmartCard activity or repeated failures in authentication logs. A sudden spike may indicate exploitation attempts.