CVE-2026-5281 - Vulnerability Analysis
HighCVSS: 8.8Last Updated: April 2, 2026
Google Chrome - Use After Free
Overview
Google Chrome < 146.0.7680.178 contains a use after free vulnerability in Dawn, letting remote attackers who have compromised the renderer process execute arbitrary code via crafted HTML, exploit requires compromised renderer process.
Severity & Score
Impact
Remote attackers with renderer process access can execute arbitrary code, potentially leading to full system compromise.
Mitigation
Update to version 146.0.7680.178 or later.
References
- https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html
- https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit
- https://issues.chromium.org/issues/491518608
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5281
Social Media Activity(13 posts)
Critical Chrome Zero-Day CVE-2026-5281 Sparks Urgent Global Security Response + Video Introduction: A Silent Browser Threat Escalates into a National Security Concern A newly discovered vulnerability inside Google Chrome’s graphics engine has quickly evolved from a technical flaw into a high-priority cybersecurity emergency. With active exploitation already confirmed in the wild, government agencies and security experts are sounding the alarm. The issue, tied to… https://undercodenews.com/critical-chrome-zero-day-cve-2026-5281-sparks-urgent-global-security-response-video/
View original post
🚨 [CISA-2026:0401] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0401) CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. ⚠️ CVE-2026-5281 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-5281) - Name: Google Dawn Use-After-Free Vulnerability - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Known To Be Used in Ransomware Campaigns? Unknown - Vendor: Google - Product: Dawn - Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-5281 #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260401 #cisa20260401 #cve_2026_5281 #cve20265281
View original postGoogle Chrome Security Release Addresses Critical Zero-Day CVE-2026-5281 and 21 Vulnerabilities + Video Introduction: Urgent Browser Update After Active Exploitation Detected Google has issued a critical security update for its Chrome browser, responding to an actively exploited zero-day vulnerability that has already been observed in real-world attacks. The flaw, identified as CVE-2026-5281, affects a core graphics component and raises serious concerns about user… https://undercodenews.com/google-chrome-security-release-addresses-critical-zero-day-cve-2026-5281-and-21-vulnerabilities-video/
View original post
CVE ID: CVE-2026-5281 Vendor: Google Product: Dawn Date Added: 2026-04-01 Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-5281 CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5281
View original post
🟠 CVE-2026-5281 - High (8.8) Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5281/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original post
Google on Tuesday released security updates for its Chrome web browser to address 21 vulnerabilities, including a zero-day flaw that it said has been exploited in the wild. https://thehackernews.com/2026/04/new-chrome-zero-day-cve-2026-5281-under.html
View original post
🚨 [CISA-2026:0401] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0401) CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. ⚠️ CVE-2026-5281 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-5281) - Name: Google Dawn Use-After-Free Vulnerability - Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Known To Be Used in Ransomware Campaigns? Unknown - Vendor: Google - Product: Dawn - Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-5281 #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260401 #cisa20260401 #cve_2026_5281 #cve20265281
View original post
CVE ID: CVE-2026-5281 Vendor: Google Product: Dawn Date Added: 2026-04-01 Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-5281 CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5281
View original post
🟠 CVE-2026-5281 - High (8.8) Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5281/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original post
CVE-2026-5281 (Use after free in Dawn) included with this is a zero day
View original postAmongst other security improvements from Chromium upstream it includes a fix for CVE-2026-5281 (Use after free in Dawn), which has a known exploit in the wild.
View original postAmongst other security improvements from Chromium upstream it includes a fix for CVE-2026-5281 (Use after free in Dawn), which has a known exploit in the wild.
View original post
Upstream release notes have been published. This release includes fixes for 21 CVES. Google is aware that an exploit for CVE-2026-5281 exists in the wild. https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html RE: https://bsky.app/profile/did:plc:6ol7vfhxcbk3ylrlbbioxlav/post/3mifg4rzfh22x https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html
View original postGitHub Repositories(1 repo)
Related Resources
Details
- CVE ID
- CVE-2026-5281
- Severity
- High
- CVSS Score
- 8.8
- Type
- use_after_free
- Status
- confirmed
- EPSS
- 3.8%
- Social Posts
- 13
CWE
- CWE-416
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H