CVE-2026-106295
Chromium CVE-2026-106295: Incorrect authorization
CVE-2026-106295 is fixed in 9 products on 3 platforms, first by Microsoft Edge Dev 156.0.4285.0, released September 17, 2026. It is not reported as exploited. Patch Radar priority: Routine.
RoutineFixed on 3 platforms
CVSS
4.2
Moderate
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0017
6th percentile
<p>This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see <a href="https://chromereleases.googleblog.com/2026">Google Chrome Releases</a> for more information.</p>
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Google Chrome (EXE) | 155.0.8059.40 | Google Chrome (EXE) 155.0.8059.40 | Oct 6, 2026 |
| Google Chrome Beta (EXE) | 156.0.8078.4 | Google Chrome Beta (EXE) 156.0.8078.4 | Sep 30, 2026 |
| Google Chrome Dev (EXE) | 156.0.8063.3 | Google Chrome Dev (EXE) 156.0.8063.3 | Sep 18, 2026 |
| Microsoft Edge | 155.0.4283.45 | Microsoft Edge 155.0.4283.45 | Oct 8, 2026 |
| Microsoft Edge Beta | 156.0.4314.8 | Microsoft Edge Beta 156.0.4314.8 | Oct 6, 2026 |
| Microsoft Edge Dev | 156.0.4285.0 | Microsoft Edge Dev 156.0.4285.0 | Sep 17, 2026 |
| Microsoft Edge WebView2 Runtime | 155.0.4283.45 | Microsoft Edge WebView2 Runtime 155.0.4283.45 | Oct 8, 2026 |
| macOS | |||
| Google Chrome | 155.0.8059.40 | Google Chrome 155.0.8059.40 | Oct 6, 2026 |
| Microsoft Edge | 155.0.4283.45 | Microsoft Edge 155.0.4283.45 | Oct 7, 2026 |
| Linux | |||
| chromium · Debian 12.15 (bookworm) | 155.0.8059.39-1~deb12u1 | DEBIAN-CVE-2026-106295 | Oct 12, 2026 |
| chromium · Debian 13.5 (trixie) | 155.0.8059.39-1~deb13u1 | DEBIAN-CVE-2026-106295 | Oct 12, 2026 |
| chromium · Debian 14 | 155.0.8059.39-1 | DEBIAN-CVE-2026-106295 | Oct 12, 2026 |