Vulnerabilities
Microsoft Edge Patch for CVE‑2026‑95375: BrowserTag Authorization Flaw
A Chromium BrowserTag authorization flaw (CVE‑2026‑95375) affects all Chromium‑based browsers. Microsoft Edge will receive the fix via its standard update channel. Defenders should update immediately and verify the patch.
What happened
A flaw in Chromium’s BrowserTag component (CVE‑2026‑95375) allows an attacker to bypass authorization checks, potentially enabling unauthorized actions within the browser context.
Impact
Any Chromium‑based browser that has not yet applied the latest update is vulnerable. Microsoft Edge, which incorporates the Chromium engine, will receive the fix automatically through its standard update channel.
Affected
- Microsoft Edge (Chromium‑based) – all versions prior to the latest release
- Other Chromium‑based browsers (e.g., Chrome, Brave, Opera) – if they have not applied the corresponding patch
What to do
- Ensure Windows Update is enabled and install the latest Microsoft Edge update immediately.
- Verify the browser version (Edge 120+ or equivalent Chromium commit) to confirm the patch is present.
- For environments using other Chromium‑based browsers, check vendor release notes and apply the update as soon as available.
- Monitor Microsoft Security Response Center (MSRC) and Chromium release blogs for any additional advisories.
Mitigation
Apply the latest browser update; no work‑arounds are available until the patch is installed.
Related vulnerabilities
CVE-2026-95314: Incorrect Authorization in Chromium HID – Edge Users Must Update
A flaw in Chromium’s HID handling allows improper authorization, affecting all Chromium‑based browsers including Microsoft Edge. The issue is fixed in the latest Chromium releases, and Edge will receive the patch in its next update. Defenders should verify their browser versions and apply updates immediately.
Read briefing
Chromium CVE‑2026‑95352: DevTools Authorization Flaw Fixed in Edge
A recent CVE‑2026‑95352 flaw in Chromium’s DevTools allowed an attacker to bypass authorization checks and gain privileged access to debugging functions. Microsoft Edge (Chromium‑based) has incorporated the fix. Defenders should ensure browsers are updated and monitor DevTools usage.
Read briefing
Chromium CVE-2026-95312: Password Information Leak in Edge
A flaw in Chromium’s password handling can leak credentials. Microsoft Edge users are affected and should update immediately. Defenders should verify patch status and monitor for exposed data.
Read briefing
Chromium CVE‑2026‑95356: Use‑After‑Free in WindowDialog
A use‑after‑free flaw in Chromium’s WindowDialog component (CVE‑2026‑95356) can enable arbitrary code execution via malicious web content. Microsoft Edge, which incorporates Chromium, is affected until the patch is applied. Defenders should update to the latest Edge release and monitor for anomalous browser activity.
Read briefing