Microsoft Edge (Chromium) Vulnerability CVE-2026-106384: Missing Authorization – Update Required

What happened

A missing authorization flaw (CVE-2026-106384) was identified in the Chromium engine. The bug allows an attacker to bypass access controls within the browser, potentially enabling unauthorized actions.

Impact

• Microsoft Edge (Chromium-based) and other Chromium-based browsers are affected.
• Potential for privilege escalation or unauthorized data access within the browser context.
• No known exploitation in the wild yet, but the flaw is considered high severity.

Mitigation

• Apply the latest Microsoft Edge update (version 120 or later).
• Verify that the update includes the Chromium patch for CVE-2026-106384.
• For environments that cannot update immediately, disable any privileged extensions or features that rely on the affected API.

What to do

• Run Windows Update to install the newest Edge release.
• Check the installed Edge version against the vendor’s release notes.
• Monitor security logs for anomalous browser activity and enforce least-privilege policies for extensions.
• Consider enabling Microsoft Defender Application Guard for Edge to contain potential exploitation.