Microsoft Edge (Chromium) Affected by CVE-2026-106235 Use-After-Free Vulnerability

Microsoft Edge, built on Chromium, is impacted by a use‑after‑free vulnerability identified as CVE‑2026‑106235. The flaw allows an attacker to trigger memory corruption by manipulating the browser’s rendering pipeline.

What happened

The vulnerability originates from an improper deallocation of a memory object in Chromium’s rendering engine. When a malicious webpage triggers the flaw, the browser may access freed memory, potentially leading to arbitrary code execution.

Impact

• Affected products: Microsoft Edge (Chromium‑based) versions prior to the latest Chromium update.
• Potential impact: Remote code execution, data exfiltration, or denial of service.
• Severity: High (assessed by Microsoft Security Response Center).

What to do

• Verify your Edge version: edge://settings/help and ensure it is at least the latest Chromium build.
• Apply the update immediately; Microsoft releases the patch as part of the regular Edge update cycle.
• Monitor logs for anomalous activity that could indicate exploitation attempts.
• Consider disabling third‑party extensions until the update is confirmed, as extensions can exacerbate rendering issues.

Microsoft recommends following the update schedule and checking the Microsoft Security Response Center for any additional mitigations.