Microsoft Edge (Chromium) Vulnerability CVE-2026-106403: Incorrect Authorization

What happened

A flaw in Chromium's authorization logic (CVE-2026-106403) permits unauthorized access to privileged resources. The bug was identified by Chrome and subsequently propagated to Microsoft Edge (Chromium-based).

Impact

Edge users running affected versions may be able to bypass normal authorization checks, potentially enabling privilege escalation or unauthorized data access. The vulnerability applies broadly to any component relying on Chromium's authorization mechanisms.

Mitigation

• Update Microsoft Edge to the latest available version; the patch is included in the current release.
• Verify the installed Edge version by navigating to edge://settings/help.
• On systems where automatic updates are disabled, manually download the latest installer from the official Microsoft Edge download page.
• For environments that rely on legacy Edge (pre‑Chromium), no action is required as the flaw does not affect that branch.

What to do

Defenders should:

• Ensure all Edge installations are up‑to‑date.
• Monitor authentication logs for anomalous privilege escalation attempts.
• Apply any relevant group policy or endpoint protection rules that restrict privileged actions until the patch is deployed.
• Consider disabling Edge features that rely on the affected authorization logic if patch deployment is delayed.

Google Chrome releases page notes that the issue has been fixed in the latest stable release.