Chrome Zero-Day CVE-2026-5281 Actively Exploited — Patch Now

CVE-2026-5281 is a use-after-free vulnerability in Dawn, the open-source WebGPU implementation used by Google Chrome. Google confirmed that an exploit exists in the wild. Update Chrome immediately.

Affected versions: Chrome prior to 146.0.7680.178 on Windows and macOS; prior to 146.0.7680.177 on Linux.

Fix: Chrome 146.0.7680.177 / 146.0.7680.178. Navigate to More menu → Help → About Google Chrome and click Relaunch to apply the update. It takes under 30 seconds.

What it allows: A remote attacker who has compromised the renderer process can execute arbitrary code via a crafted HTML page. Use-after-free bugs in graphics subsystems are reliable exploitation targets — memory that’s been freed gets reused in a predictable window, allowing an attacker to control execution flow. The Dawn WebGPU layer sits between JavaScript and GPU hardware, meaning a renderer compromise plus this bug chains into native code execution.

CISA added CVE-2026-5281 to its Known Exploited Vulnerabilities catalog on April 1, 2026. Federal civilian agencies are required to patch by April 15. That deadline applies to U.S. government systems, but the underlying urgency is universal — if it’s in CISA’s KEV catalog, it’s being used in active campaigns.

Chromium-based browsers — Microsoft Edge, Brave, Opera, Vivaldi — all share the Dawn codebase. Patches for those browsers should follow within days. If you manage a fleet of enterprise browsers, don’t wait for the stragglers to auto-update. Push the patch via your MDM or group policy.

This is the second Chrome zero-day this year that’s reached active exploitation before the patch cycle completed. The pattern is consistent with how threat actors target browser-level vulnerabilities: renderer exploits are found and held until they can be chained with something useful like a local privilege escalation, then deployed in targeted attacks before defenders catch up.

The CVSS score has not been formally assigned as of publication, but the combination of renderer-to-native-exec chain and active exploitation puts practical severity at critical.

Action items:

1. Update Chrome to 146.0.7680.177 or 146.0.7680.178 right now
2. Push updates to any managed Chrome fleet via MDM
3. Monitor for Edge/Brave/Opera updates and deploy within 48 hours
4. If you run Chromium builds internally, update the Dawn dependency and rebuild