Skip to content
NewA calmer, faster ZeroHour
VulnerabilityKEV2

CVE-2026-5281

Use-After-Free in Google Chrome's Dawn (WebGPU) Component Enables Arbitrary Code Execution

CISA: Google Dawn Use-After-Free Vulnerability

CVSS 3.1
8.8 high
EPSS
14%p97
Published
·
Added to KEV
Analyze CVE-2026-5281 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

CVE-2026-5281 is a use-after-free vulnerability in Dawn, the WebGPU implementation in Google Chrome, that Google patched in Chrome 146.0.7680.178. It is triggered when a remote attacker serves a crafted HTML page and can leverage it after having already compromised the Chrome renderer process, escalating to arbitrary code execution beyond the initial foothold. Because the flaw requires a compromised renderer as a starting point, it is typically chained with another bug (such as a renderer-exploiting issue) to break out to arbitrary code execution with real impact on confidentiality, integrity, and availability. Any user or organization running Google Chrome on a version prior to 146.0.7680.178 is affected. The flaw is confirmed as exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-04-01, and its EPSS score of 4.9% (92nd percentile) indicates a meaningful near-term exploitation probability.

What to do: Update Google Chrome to 146.0.7680.178 or later on all endpoints immediately, prioritizing internet-facing and high-risk user populations given the KEV listing. Because the bug requires a compromised renderer, treat it as part of a chained attack and ensure other browser-layer defenses (renderer sandbox enabled, prompt patching of related renderer bugs) are in place; federal agencies must follow BOD 22-01 remediation timelines or discontinue use if patching is unavailable.

ProductAffected
Google Chromeprior to 146.0.7680.178
Google Dawn (WebGPU implementation bundled in Chrome)as shipped in Chrome prior to 146.0.7680.178
Estimated exposure
masseffectively all Chrome users on unpatched builds — on the order of billions of installs worldwide — Chrome's global install base exceeds three billion users per public usage-share statistics, and any Chrome build prior to 146.0.7680.178 contains the vulnerable Dawn code, so exposure is assumed at the scale of the unpatched share of that…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

KEVCISA Known Exploited Vulnerability
Affected
Google Dawn
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due date
Ransomware use
Unknown
Vendors
google
Products
chrome
Weakness
CWE-416
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD CVE.org CISA KEV GitHub PoCs EPSS (13.7%)

In the news

20 stories