Microsoft Edge (Chromium) Vulnerability CVE‑2026‑106352: Incorrect Authorization

A recent Chromium security review identified CVE‑2026‑106352, an incorrect authorization flaw that can allow an attacker to bypass access controls on certain web resources.

What happened

The vulnerability originates in Chromium’s handling of authorization headers and token validation. Because Microsoft Edge is built on Chromium, the same code path is present in Edge.

Impact

Unauthenticated users could potentially gain access to protected content or perform actions reserved for authenticated users. The flaw does not provide remote code execution but can lead to data exposure or privilege escalation within web applications.

What to do

• Ensure Microsoft Edge is updated to the latest release (currently version X.Y.Z or later).
• Verify that other Chromium‑based browsers (e.g., Brave, Vivaldi) are also updated to their latest stable versions.
• Review your organization’s browser update policy and enforce automatic updates for all endpoints.
• Monitor Microsoft and Google release notes for any additional mitigations or workarounds.