Vulnerabilities
Microsoft Edge Vulnerability CVE-2026-106306: Incorrect Authorization in Chromium
A flaw in Chromium’s authorization logic, assigned CVE‑2026‑106306, can allow unauthorized actions when Microsoft Edge (Chromium‑based) processes certain requests. The issue is fixed in the latest Chromium releases, which Edge incorporates. Defenders should verify Edge is updated to the latest patch and monitor for anomalous access patterns.
What Happened
A bug in Chromium’s authorization handling was identified and assigned CVE‑2026‑106306 by Google. The flaw permits bypassing normal access controls under specific conditions.
Impact
Microsoft Edge users running affected Chromium versions may be exposed to unauthorized privilege escalation or data access. The vulnerability is limited to the browser context and does not affect the underlying OS directly.
Mitigation
Update Microsoft Edge to the latest version that includes the patched Chromium code. If immediate update is not possible, disable features that trigger the vulnerable code path or apply any vendor‑supplied workarounds. Monitor logs for anomalous authentication or privilege‑elevated activity.
Microsoft Edge automatically incorporates the latest Chromium security fixes.
Related vulnerabilities
Microsoft Edge (Chromium) – CVE-2026-106422 Incorrect Authorization Vulnerability
A recent CVE-2026-106422 flaw in Chromium’s authorization logic could allow attackers to bypass access controls. The issue is automatically fixed in the latest Chromium builds, which Microsoft Edge incorporates. Defenders should verify Edge is up‑to‑date and monitor for exploitation attempts.
Read briefing
Microsoft Edge Addresses Chromium CVE-2026-106297: Incorrect Authorization
A Chromium bug (CVE-2026-106297) permits incorrect authorization handling, potentially allowing malicious sites or extensions to gain elevated privileges. Microsoft Edge (Chromium-based) incorporates the upstream fix. Defenders should ensure Edge is updated and monitor for anomalous access attempts.
Read briefing
CVE-2026-95314: Incorrect Authorization in Chromium HID – Edge Users Must Update
A flaw in Chromium’s HID handling allows improper authorization, affecting all Chromium‑based browsers including Microsoft Edge. The issue is fixed in the latest Chromium releases, and Edge will receive the patch in its next update. Defenders should verify their browser versions and apply updates immediately.
Read briefing
CVE-2026-95358: Incorrect Authorization in Chromium Mobile – Edge and Chrome Update Required
A new CVE, CVE-2026-95358, exposes an incorrect authorization flaw in Chromium’s mobile implementation. The issue is present in all Chromium‑based browsers, including Microsoft Edge, and is fixed in the latest stable releases. Defenders should verify that Edge and Chrome are updated to the patched versions and monitor for any related exploitation activity.
Read briefing