Vulnerabilities
CVE-2026-106398: Incorrect Authorization in Chromium Affects Chrome and Edge
A flaw in Chromium’s authorization logic (CVE‑2026‑106398) allows unauthorized actions. The issue is present in all current Chrome and Microsoft Edge (Chromium‑based) builds until the latest patch. Defenders should verify browser versions and apply updates immediately.
Chromium’s authorization logic contains a flaw that can be exploited to perform actions without proper permissions. The vulnerability, identified as CVE‑2026‑106398, is present in all current releases of Google Chrome and Microsoft Edge (Chromium‑based) until the latest patch is applied.
Impact
Attackers who can trigger the flaw may gain elevated privileges or access restricted resources within the browser context, potentially leading to data exfiltration or malicious script execution.
Affected Versions
- Google Chrome 120.x and earlier
- Microsoft Edge 120.x and earlier (Chromium‑based)
Mitigation
- Verify the browser version on all endpoints.
- Update to the latest stable release (Chrome 121+, Edge 121+).
- Configure automatic updates to prevent re‑exposure.
- Monitor browser logs for anomalous authorization requests.
Additional Guidance
Microsoft Edge inherits the Chromium fix; ensure the Edge update channel is set to “Stable” to receive the patch promptly.
Related vulnerabilities
Microsoft Edge (Chromium) Vulnerability CVE-2026-102322: Incorrect Authorization
A Chromium-based authorization flaw (CVE-2026-102322) affects Microsoft Edge. Edge users should update to the latest release to mitigate the risk.
Read briefing
Microsoft Edge Addresses Chromium CVE-2026-106389: Incorrect Authorization
A recent CVE-2026-106389 flaw in Chromium allows incorrect authorization. Microsoft Edge (Chromium-based) will incorporate the fix in upcoming releases. Defenders should verify Edge version and apply updates promptly.
Read briefing
CVE-2026-106381: Incorrect Authorization in Chromium – Edge Updated
Microsoft Edge (Chromium-based) has incorporated a fix for CVE-2026-106381, an incorrect authorization flaw discovered in Chromium. The patch is included in the latest Edge release. Defenders should verify that Edge and other Chromium-based browsers are updated to the latest version and monitor for any related exploitation attempts.
Read briefing
Microsoft Edge Vulnerability CVE-2026-106350: Incorrect Authorization Fix Required
A flaw in Chromium’s authorization logic (CVE‑2026‑106350) affects Microsoft Edge (Chromium‑based). The issue allows bypassing privileged checks, potentially enabling unauthorized actions. Edge users should update to the latest release to mitigate the risk.
Read briefing