Vulnerabilities
Microsoft Edge and Chromium: CVE-2026-106274 Incorrect Reference Resolution Fixed
Chromium’s CVE‑2026‑106274 flaw in reference resolution has been patched in the latest Edge release. Defenders should verify that Edge is updated to the newest stable version to mitigate potential memory corruption or code execution risks. No workarounds are required beyond applying the update.
What Happened
Chromium identified a flaw in reference resolution that could allow an attacker to manipulate how URLs are interpreted. The issue was assigned CVE-2026-106274 by the Chrome team.
Impact
Any Chromium‑based browser, including Microsoft Edge, could be affected until the patch is applied. The vulnerability may lead to memory corruption or unintended code execution if an attacker supplies a crafted reference.
Mitigation
Microsoft Edge automatically incorporates Chromium updates. Defenders should verify that Edge is running the latest stable release (currently version 121 or newer). If a system is locked to an older Edge build, manually update via Windows Update or the Microsoft Edge installer.
What to Do
- Check the current Edge version: edge://settings/help.
- Enable automatic updates or schedule a manual update.
- Monitor Microsoft Security Response Center for any follow‑up advisories.
Additional Notes
Microsoft has confirmed that the Chromium patch is fully integrated and no workarounds are required beyond applying the update.
Related vulnerabilities
Microsoft Edge Vulnerability CVE-2026-106306: Incorrect Authorization in Chromium
A flaw in Chromium’s authorization logic, assigned CVE‑2026‑106306, can allow unauthorized actions when Microsoft Edge (Chromium‑based) processes certain requests. The issue is fixed in the latest Chromium releases, which Edge incorporates. Defenders should verify Edge is updated to the latest patch and monitor for anomalous access patterns.
Read briefing
Microsoft Edge (Chromium) – CVE-2026-106422 Incorrect Authorization Vulnerability
A recent CVE-2026-106422 flaw in Chromium’s authorization logic could allow attackers to bypass access controls. The issue is automatically fixed in the latest Chromium builds, which Microsoft Edge incorporates. Defenders should verify Edge is up‑to‑date and monitor for exploitation attempts.
Read briefing
CVE-2026-95314: Incorrect Authorization in Chromium HID – Edge Users Must Update
A flaw in Chromium’s HID handling allows improper authorization, affecting all Chromium‑based browsers including Microsoft Edge. The issue is fixed in the latest Chromium releases, and Edge will receive the patch in its next update. Defenders should verify their browser versions and apply updates immediately.
Read briefing
Microsoft Edge Addresses Chromium CVE-2026-106297: Incorrect Authorization
A Chromium bug (CVE-2026-106297) permits incorrect authorization handling, potentially allowing malicious sites or extensions to gain elevated privileges. Microsoft Edge (Chromium-based) incorporates the upstream fix. Defenders should ensure Edge is updated and monitor for anomalous access attempts.
Read briefing