Full Report
Google has fixed the fourth Chrome vulnerability exploited in zero-day attacks since the start of the year. [...]
Analysis Summary
# Vulnerability: Use-After-Free in Chrome Dawn Implementation
## CVE Details
- **CVE ID:** CVE-2026-5281
- **CVSS Score:** N/A (Not yet assigned, but established as High severity by Google)
- **CWE:** CWE-416 (Use After Free)
## Affected Systems
- **Products:** Google Chrome / Chromium-based browsers.
- **Versions:** Versions prior to 146.0.7680.177/178.
- **Configurations:** Systems utilizing "Dawn," the cross-platform implementation of the WebGPU standard.
## Vulnerability Description
The flaw is a **Use-After-Free (UAF)** vulnerability residing in **Dawn**, the underlying component used by Chromium to implement the **WebGPU standard**. A UAF occurs when a program continues to use a pointer after the memory it points to has been cleared or deallocated. In the context of a browser, this can result in memory corruption, rendering issues, or application crashes. If successfully exploited, it can allow an attacker to execute arbitrary code or bypass security sandboxes.
## Exploitation
- **Status:** **Exploited in the wild.** Google has confirmed that an exploit for this CVE exists and is being actively used by threat actors.
- **Complexity:** Medium (Memory corruption exploits typically require precise heap manipulation).
- **Attack Vector:** Network (Remote via a crafted web page).
## Impact
- **Confidentiality:** High (Potential for unauthorized data access).
- **Integrity:** High (Potential for arbitrary code execution).
- **Availability:** High (Can trigger browser crashes and service disruption).
## Remediation
### Patches
Google has released stable channel updates for the following platforms:
- **Windows / macOS:** Versions 146.0.7680.177 or 146.0.7680.178.
- **Linux:** Version 146.0.7680.177.
### Workarounds
No specific functional workaround is provided. Users should prioritize the security update. Disabling WebGPU via browser flags (if applicable) may reduce the attack surface, but is not a recommended alternative to patching.
## Detection
- **Indicators of Compromise:** Unusual browser instability or crashes specifically when interacting with WebGPU-enabled sites.
- **Detection Methods and Tools:**
- EDR/Endpoint security tools can monitor for anomalous child processes spawned by Chrome.
- Security teams should verify that the Chromium version is **146.0.7680.177** or higher across the fleet.
## References
- Google Chrome Releases Blog: [https[://]chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html]
- Chromium Project (Dawn): [https[://]dawn.googlesource.com/dawn]
- BleepingComputer Advisory: [https[://]www.bleepingcomputer.com/news/security/google-fixes-fourth-chrome-zero-day-exploited-in-attacks-in-2026/]