Vulnerability intelligence
CVE-2026-5281
Google Dawn Use-After-Free Vulnerability
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVSS Score
—
High
EPSS — Exploit Probability
0.7%
Riskier than 52% of all CVEs · checked 2026-10-16
Exploitation
Confirmed in the wild
KEV since 2026-04-01
Remediation
Patch available
Federal deadline 2026-04-15
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-04-15.
12 articles across 6 outlets · first covered Apr 1, 2026 · latest Sep 9, 2026
Coverage timeline
-
Google Patches Chrome’s Seventh Zero Day of 2026 Under Attacksecurityaffairs.com · Sep 9, 2026
-
Chrome Patches Exploited V8 Zero Day Allowing Code Executionthehackernews.com · Sep 9, 2026
-
CISA Flags Actively Exploited Chrome Flaw as Sixth 2026 Zero-Daysecurityaffairs.com · Sep 4, 2026
-
Google Patches Actively Exploited Chrome V8 Zero Daysecurityaffairs.com · Sep 4, 2026
-
Google Patches Chrome Zero Day Exploited in V8 Attacksthehackernews.com · Sep 4, 2026
-
CVE-2026-5281: Chrome WebGPU Zero-Day Exploited In The Wildsocradar.io · Apr 2, 2026
-
CISA Adds CVE-2026-5281 to Known Exploited Vulnerabilities Cataloguewww.cisa.gov · Apr 2, 2026
-
U.S. CISA adds a flaw in Google Dawn to its Known Exploited Vulnerabilities catalogsecurityaffairs.com · Apr 2, 2026
-
CISA Adds CVE-2026-5281 to Known Exploited Vulnerabilities Cataloguecisa.gov · Apr 1, 2026
-
Google fixes fourth actively exploited Chrome zero-day of 2026securityaffairs.com · Apr 1, 2026
-
Exploited Zero-Day Among 21 Vulnerabilities Patched in Chromewww.securityweek.com · Apr 1, 2026
-
New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation — Patch Releasedthehackernews.com · Apr 1, 2026