CVE-2026-5281
Published: 01 April 2026
Description
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, testing, and installation of patches for known flaws, directly mitigating this use-after-free vulnerability via the Chrome update to 146.0.7680.178.
Implements memory safeguards like ASLR and DEP to protect against use-after-free exploitation in the Dawn WebGPU component.
Provides process isolation through renderer sandboxing, containing arbitrary code execution to the compromised renderer process.
Security SummaryAI
CVE-2026-5281 is a use-after-free vulnerability (CWE-416) in the Dawn component of Google Chrome prior to version 146.0.7680.178. Dawn is a WebGPU implementation within Chromium, and the issue was assigned a High severity rating by the Chromium security team. It was published on 2026-04-01 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
The vulnerability can be exploited by a remote attacker who has already compromised the renderer process in Chrome. Exploitation occurs through a crafted HTML page, enabling the attacker to execute arbitrary code. The attack requires user interaction, such as visiting a malicious webpage, but demands no special privileges and has low complexity over the network.
Google's Chrome Releases blog announces the stable channel update to version 146.0.7680.178, which addresses the issue. The flaw is tracked in Chromium issue 491518608. Mitigation centers on applying this patch promptly, as recommended in the advisories.
The vulnerability appears in CISA's Known Exploited Vulnerabilities Catalog, indicating real-world exploitation.
Details
- CWE(s)
- KEV Date Added
- 01 April 2026
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free vulnerability in Chrome's renderer (Dawn WebGPU) exploited via crafted HTML webpage for arbitrary code execution with user interaction (visiting malicious page), directly enabling Exploitation for Client Execution (T1203) and Drive-by Compromise (T1189).