Vulnerabilities
CVE-2026-95358: Incorrect Authorization in Chromium Mobile – Edge and Chrome Update Required
A new CVE, CVE-2026-95358, exposes an incorrect authorization flaw in Chromium’s mobile implementation. The issue is present in all Chromium‑based browsers, including Microsoft Edge, and is fixed in the latest stable releases. Defenders should verify that Edge and Chrome are updated to the patched versions and monitor for any related exploitation activity.
What Happened
The Chromium project identified an incorrect authorization bug in its mobile code path, assigned CVE-2026-95358. The flaw could allow a malicious actor to bypass access controls when interacting with mobile web content.
Impact
All browsers built on Chromium—including Microsoft Edge, Chrome, and other derivatives—are affected. The vulnerability is limited to mobile contexts and does not affect desktop browsers. No widespread exploitation has been reported yet.
Mitigation
- Update Microsoft Edge to the latest stable build (Edge 121 or newer).
- Update Google Chrome to the latest stable build (Chrome 121 or newer).
- Verify that the update includes the Chromium patch referenced in the Google Chrome release notes.
- For managed devices, push the update via your MDM or update management solution.
Monitoring
Watch for indicators of compromise such as unexpected authentication requests or anomalous mobile traffic. No known exploit signatures are available at this time.
Related vulnerabilities
Microsoft Edge Addresses Chromium Safe Browsing Authorization Flaw (CVE-2026-95292)
A recent Chromium vulnerability (CVE-2026-95292) exposed incorrect authorization handling in Safe Browsing. Microsoft Edge, built on Chromium, has incorporated the fix. Update Edge to mitigate the risk.
Read briefing
Microsoft Edge Mobile UI Misrepresentation – CVE-2026-95288
Microsoft Edge on mobile devices is affected by CVE-2026-95288, a Chromium-based UI misrepresentation flaw. The issue is fixed in newer Chromium builds; update Edge to the latest version to mitigate.
Read briefing
Chromium CVE-2026-95296: Missing authorization in Core; update Chrome and Edge
Chromium CVE-2026-95296 reports a missing authorization issue in Core, with Microsoft Edge expected to inherit the fix through Chromium updates. Public details are limited, so defenders should deploy current Chrome and Edge stable releases and verify update channels. Custom Chromium-based applications should be checked for delayed patching.
Read briefing
Microsoft Edge Patch for CVE‑2026‑95375: BrowserTag Authorization Flaw
A Chromium BrowserTag authorization flaw (CVE‑2026‑95375) affects all Chromium‑based browsers. Microsoft Edge will receive the fix via its standard update channel. Defenders should update immediately and verify the patch.
Read briefing