Vulnerabilities
Microsoft Edge: CVE-2026-95276 Improper Theme Input Validation Fixed
A flaw in Chromium’s theme handling (CVE‑2026‑95276) could allow malicious input to trigger code execution. Microsoft Edge (Chromium‑based) has incorporated the fix in recent releases. Defenders should verify that Edge is updated to the latest version and consider disabling third‑party themes until the patch is applied.
What Happened
The Chromium engine contained an improper input validation bug in its theme subsystem (CVE‑2026‑95276). Maliciously crafted theme files could be parsed in a way that bypassed validation, potentially leading to arbitrary code execution or cross‑site scripting within the browser context.
Impact
- Affected products: Microsoft Edge (Chromium‑based) and any other Chromium‑based browsers that have not yet applied the patch.
- Potential impact: Remote code execution or XSS if a user installs a malicious theme.
Mitigation
- Update Edge to the latest version (currently 120.x or later) where the Chromium patch is included.
- Disable or remove third‑party themes until the update is confirmed.
- Audit installed themes for unknown or unsigned sources.
What to Do
- Run Windows Update or Edge update channel to ensure the latest security patches are installed.
- Use group policy or endpoint management to enforce theme restrictions.
- Monitor for anomalous theme installation activity and block suspicious files.
Related vulnerabilities
Chromium CVE-2026-95364: Improper Password Input Validation Fixed in Edge
A flaw in Chromium’s password handling allowed improper input validation, potentially exposing credentials. Microsoft Edge (Chromium‑based) incorporates the fix. Defenders should verify Edge is updated to the latest version and monitor for credential leakage.
Read briefing
Microsoft Edge Vulnerability CVE-2026-95370: NFC Implementation Flaw
A flaw in Chromium’s NFC handling (CVE‑2026‑95370) can allow attackers to exploit improper data validation. Microsoft Edge, built on Chromium, inherits the issue. Defenders should verify Edge is updated to the latest release and consider disabling NFC features if not required.
Read briefing
Chromium CVE-2026-106299 Improper Input Validation Affects Edge and Other Chromium Browsers
An improper input validation flaw in Chromium (CVE-2026-106299) can be exploited by attackers to potentially execute arbitrary code or perform malicious actions in browsers that use the affected engine. Microsoft Edge and other Chromium‑based browsers are impacted. Defenders should verify the browser version and apply the latest security update immediately.
Read briefing
CVE-2026-95314: Incorrect Authorization in Chromium HID – Edge Users Must Update
A flaw in Chromium’s HID handling allows improper authorization, affecting all Chromium‑based browsers including Microsoft Edge. The issue is fixed in the latest Chromium releases, and Edge will receive the patch in its next update. Defenders should verify their browser versions and apply updates immediately.
Read briefing