CVE-2026-5281
Google Dawn Use-After-Free Vulnerability
Description
CVE-2026-5281 is a HIGH severity use-after-free vulnerability in Google Chrome's Dawn component (the WebGPU implementation), carrying a CVSS 3.1 score of 8.8. Dawn translates WebGPU API calls to native GPU backends (Vulkan, Metal, Direct3D), and the use-after-free condition in this component allows a remote attacker who has already compromised the renderer process to execute arbitrary code via crafted HTML content. This is the fourth Chrome zero-day vulnerability discovered in 2026. Affected versions include Chrome prior to 146.0.7680.178 on Windows and macOS, and prior to 146.0.7680.177 on Linux. Other Chromium-based browsers including Microsoft Edge and Opera are also affected. The vulnerability was reported by a pseudonymous researcher. CISA added CVE-2026-5281 to the KEV catalog on April 1, 2026, with a remediation deadline of April 15, 2026. The EPSS score of 0.033 (3.3%) reflects active but targeted exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 146.0.7680.177 |
References
- https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html(Vendor Advisory)
- https://issues.chromium.org/issues/491518608(Issue Tracking, Permissions Required)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5281(US Government Resource)
Weakness Type
Use-After-Free (UAF)
Use-after-free is a memory corruption vulnerability class that occurs when a program continues to reference memory after it has been freed and potentially reallocated for a different purpose. When the freed memory is reused by another allocation, subsequent accesses through the dangling pointer can read or write unintended data, leading to information disclosure, data corruption, or arbitrary code execution. In C and C++ codebases, use-after-free vulnerabilities are among the most commonly exploited memory safety issues.
In CVE-2026-5281, the use-after-free occurs within Dawn, Chrome's implementation of the WebGPU specification. Dawn serves as a translation layer that converts WebGPU API calls into native GPU instructions for Vulkan (Linux, Android), Metal (macOS, iOS), and Direct3D (Windows). The GPU resource management within Dawn involves complex object lifetime tracking across multiple execution contexts (JavaScript, GPU command buffers, driver callbacks). The use-after-free condition arises when a GPU resource object is freed but a reference to it persists in another execution context, allowing attacker-controlled data to be placed in the freed memory region and subsequently used as a legitimate GPU resource object, enabling code execution.
Impact Analysis
CVE-2026-5281 carries a CVSS 3.1 score of 8.8 (HIGH), reflecting the potential for full system compromise through browser-based exploitation.
Confidentiality (High): Successful exploitation enables the attacker to escape the renderer sandbox (when combined with additional techniques) and execute arbitrary code with the privileges of the browser process or the current user. This provides access to all data accessible to the user, including files, credentials, browser session data, cookies, saved passwords, and data from other browser tabs and profiles.
Integrity (High): Arbitrary code execution allows the attacker to modify files, install malware, alter browser configurations, inject content into web pages, and deploy persistence mechanisms. The attacker can leverage browser-level access to perform actions on behalf of the user across all authenticated web sessions.
Availability (High): The attacker can crash the browser, terminate processes, or consume system resources. More critically, the code execution capability enables deployment of payloads that impact system-wide availability, including ransomware or destructive malware.
Exploitation Context: The vulnerability requires a compromised renderer process as a prerequisite, which means it is typically chained with another vulnerability that first compromises the renderer (such as a JavaScript engine bug). However, the Chrome renderer sandbox is a critical security boundary, and escaping it through Dawn represents a significant escalation. As the fourth Chrome zero-day in 2026, this vulnerability is part of an accelerating trend of browser exploitation.
Exploit Maturity
Active Exploitation: CVE-2026-5281 is confirmed to be actively exploited in the wild, as evidenced by its inclusion in CISA's KEV catalog on April 1, 2026, with a remediation deadline of April 15, 2026. Google has acknowledged the vulnerability with a security update, consistent with their practice for actively exploited zero-days.
Zero-Day Status: This is the fourth Chrome zero-day vulnerability identified in 2026, indicating sustained interest from sophisticated threat actors in browser-based exploitation chains. The use of WebGPU/Dawn as an exploitation target reflects the expanding browser attack surface as new APIs are added.
Exploit Complexity: Exploitation requires a compromised renderer process, meaning the vulnerability is typically used as part of a multi-stage exploit chain. The attacker first exploits a separate vulnerability to gain code execution within the renderer sandbox, then leverages CVE-2026-5281 to escape the sandbox or gain additional capabilities. This chained exploitation pattern is characteristic of advanced threat actors and commercial spyware vendors.
Reporter: The vulnerability was reported by a pseudonymous researcher identified only by the hash 86ac1f1587b71893ed2ad792cd7dde32. The use of pseudonymous reporting is common for vulnerabilities discovered through sensitive contexts, including government-sponsored research or findings related to active exploitation campaigns.
Cross-Browser Impact: Since the vulnerability exists in Dawn, which is part of the Chromium project, all Chromium-based browsers are affected, including Microsoft Edge, Opera, Brave, and Vivaldi. This significantly expands the attack surface beyond Chrome users alone.
EPSS Context: The EPSS score of 0.033 (3.3%) is consistent with targeted exploitation rather than mass commodity attacks, which is typical for browser zero-days that require sophisticated exploit chains.
Remediation
-
Update Chrome and all Chromium-based browsers immediately. Update Google Chrome to version 146.0.7680.178 or later on Windows and macOS, and 146.0.7680.177 or later on Linux. Also update Microsoft Edge, Opera, Brave, and any other Chromium-based browsers to versions that incorporate the Dawn security fix. Enable automatic updates to ensure timely patching for future zero-days.
-
Verify browser versions across the organization. Use endpoint management tools to identify all Chromium-based browser installations and their versions. Ensure no instances remain on vulnerable versions. Pay particular attention to systems that may not receive automatic updates, such as kiosk systems, shared workstations, or systems with restricted update policies.
-
Implement browser security hardening. Enable Site Isolation (enabled by default in modern Chrome) to strengthen the renderer sandbox boundary. Consider enabling Enhanced Safe Browsing in Chrome settings for additional protection against malicious sites. Restrict or disable WebGPU if it is not needed for business operations by setting the chrome://flags/#enable-unsafe-webgpu flag or via enterprise policy.
-
Deploy network-level protections. Ensure web proxy and gateway security solutions are updated with detection rules for exploitation attempts targeting browser vulnerabilities. Block known malicious domains associated with browser exploitation campaigns. Implement DNS-level filtering to reduce exposure to drive-by download sites.
-
Monitor for indicators of compromise. Watch for unexpected browser crashes, unusual GPU process behavior, anomalous child process creation from browser processes, and suspicious network connections originating from browser processes. Review endpoint detection and response (EDR) alerts for browser exploitation indicators.
-
Assess exposure for high-risk users. Users who access untrusted web content, handle sensitive data, or are high-value targets (executives, IT administrators, security personnel) should be prioritized for immediate patching and may benefit from additional protections such as browser virtualization or isolated browsing environments.
Technical Details
CVE-2026-5281 is a use-after-free vulnerability in Dawn, the WebGPU implementation within Google Chrome and other Chromium-based browsers.
CVSS 3.1 Vector Analysis: The score of 8.8 is based on Attack Vector (Network), Attack Complexity (Low), Privileges Required (Low — compromised renderer), User Interaction (None after initial page load), Scope (Unchanged), and High impact across Confidentiality, Integrity, and Availability.
WebGPU and Dawn Architecture: WebGPU is a modern graphics API exposed to web content for GPU-accelerated computation and rendering. Dawn is Chromium's implementation of the WebGPU specification, serving as a translation layer between the JavaScript WebGPU API and native GPU backends: Vulkan on Linux and Android, Metal on macOS and iOS, and Direct3D 12 on Windows. Dawn manages GPU resources including buffers, textures, pipelines, bind groups, and command encoders, coordinating their lifecycles across the JavaScript garbage collector, the GPU command queue, and the native GPU driver.
Use-After-Free Mechanism: The vulnerability arises from incorrect object lifetime management within Dawn. GPU resource objects in Dawn have complex lifecycles that span multiple execution contexts: they are created via JavaScript API calls, referenced in GPU command buffers that execute asynchronously on the GPU, and may have additional references from the native GPU driver. The use-after-free occurs when a resource is freed (either through explicit JavaScript destroy() calls or garbage collection) while outstanding references exist in another context (such as a pending GPU command buffer or driver callback). When the freed memory is reallocated and the dangling reference is subsequently accessed, the attacker can control the contents of the reallocated memory to achieve type confusion and ultimately arbitrary code execution.
Exploitation Prerequisites: Exploitation requires the attacker to have already compromised the Chrome renderer process, typically through a separate vulnerability in the V8 JavaScript engine, the DOM implementation, or another renderer component. From the compromised renderer, the attacker can craft WebGPU API calls that trigger the use-after-free in Dawn, which runs in the GPU process — a separate process with different privileges and sandbox restrictions than the renderer.
Affected Platforms: Chrome prior to 146.0.7680.178 on Windows and macOS, and prior to 146.0.7680.177 on Linux. Since Dawn is a Chromium component, all downstream browsers based on Chromium (Edge, Opera, Brave, etc.) are affected until they incorporate the fix.
Frequently Asked Questions
What is CVE-2026-5281?
CVE-2026-5281 is a use-after-free vulnerability in Dawn, the WebGPU implementation in Google Chrome and other Chromium-based browsers. It allows an attacker who has already compromised the browser's renderer process to execute arbitrary code by exploiting incorrect GPU resource lifetime management. It is the fourth Chrome zero-day of 2026 and is being actively exploited.
Am I affected if I don't use Chrome?
You are still affected if you use any Chromium-based browser, including Microsoft Edge, Opera, Brave, or Vivaldi. The vulnerability exists in Dawn, which is part of the shared Chromium codebase. Update all Chromium-based browsers, not just Chrome.
What does "compromised renderer" mean as a prerequisite?
Chrome uses a multi-process architecture where web content runs in a sandboxed renderer process. CVE-2026-5281 requires the attacker to first compromise this renderer (typically via a JavaScript engine bug or similar vulnerability), then use the Dawn vulnerability to escalate privileges. This means it is part of a multi-stage exploit chain, which is typical for sophisticated browser attacks.
How can I check if my Chrome version is patched?
Navigate to chrome://settings/help or click the three-dot menu and go to Help > About Google Chrome. The browser will display its current version and check for updates. Ensure you are running version 146.0.7680.178 or later on Windows/macOS, or 146.0.7680.177 or later on Linux.
Should I disable WebGPU as a mitigation?
If WebGPU is not required for your business operations, disabling it reduces your attack surface. You can disable it via Chrome enterprise policies or by navigating to chrome://flags and disabling the WebGPU flag. However, the primary recommendation is to update to the patched version rather than relying on feature disabling.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.