WORLD WATCH · October 16, 2026 · EXPOSURE
Two Chromium CVEs fixed in Microsoft Edge
Microsoft Edge ingests Chromium, and Chromium addresses two missing authorization CVEs.
- Reported by
- MSRC
- Outlets reporting
- 1
- Category
- EXPOSURE
- Identifiers
- CVE-2026-106288, CVE-2026-106289
- Newest report
- October 16, 2026
Plain-English brief. Written for readers who work in a second language.
Key takeaways
- Two Chromium CVEs describe missing authorization.
- Chrome assigned both CVEs.
- Microsoft Edge ingests Chromium, which addresses them.
- MSRC published both advisories on 2026-10-16.
What happened
The report comes from MSRC. MSRC published both advisories on 2026-10-16. MSRC listed two Chromium CVEs: CVE-2026-106288 and CVE-2026-106289. The two CVEs have consecutive identifiers. Both advisories share the same publication time. Chrome assigned both CVEs. Both CVEs describe missing authorization. Microsoft Edge is Chromium-based. The advisories point readers to Google Chrome Releases. Microsoft Edge ingests Chromium, which addresses each vulnerability.
Why it matters
Edge users receive the Chromium fix through Edge updates. The CVEs concern missing authorization.
What to do
- Update Microsoft Edge to the latest version.
- Review the Google Chrome Releases page for CVE details.
- Track both CVEs in your vulnerability management process.
SOURCE: INTEL128 WORLD WATCH (UPDATED OCT 16, 2026). This brief summarizes reporting by MSRC. Intel128 writes the summary and credits the outlet. Read the summary as a starting point, not as a substitute for the original reporting.