Google has patched CVE-2026-5281, a high-severity use-after-free flaw in Dawn, the Chrome component that implements the WebGPU standard, and says an exploit already exists in the wild. The Hacker News reports it is the fourth actively exploited Chrome zero-day Google has fixed in 2026. If you have not updated Chrome since the end of March, do it now.
What happened
Google shipped the fix on March 31, 2026, according to CyberInsider, which also reports the flaw was reported to Google on March 10. Google says it is aware that an exploit exists in the wild but has not shared how it is being used or who is behind it.
The National Vulnerability Database description, as relayed by The Hacker News, says an attacker who has already compromised Chrome’s renderer process could use a crafted web page to run arbitrary code. Our analysis: that suggests the bug is used as one step in a longer attack chain rather than on its own. No severity score was published in the report we reviewed.
The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on April 1, 2026, and set an April 15, 2026 deadline for federal civilian agencies to apply the fix. The same Chrome release fixes 21 vulnerabilities in total, per The Hacker News.
Who is affected
Anyone running Chrome on Windows, macOS or Linux with a version older than 146.0.7680.177 (Linux) or 146.0.7680.177/178 (Windows and macOS). Other browsers built on Chromium, including Edge, Brave, Opera and Vivaldi, need their own vendors’ fixes, which The Hacker News says users should apply as they become available.
What to do
- Open Chrome, go to the menu, then Help, then About Google Chrome. Let it update, then click Relaunch.
- Confirm the version is 146.0.7680.177 or later (177 or 178 on Windows and macOS).
- If you use Edge, Brave, Opera or Vivaldi, check for updates and install them as soon as they are available.
- Our analysis: organizations should push the update through their device management tools and treat it as high priority, since it is on CISA’s exploited-vulnerabilities list.
What we still do not know
Google has not said who is exploiting the flaw, how many users were targeted, or which other bugs were used alongside it. Details may change as researchers publish more.
Sources: The Hacker News (Apr. 1, 2026); CyberInsider (Apr. 1, 2026).
Editor’s note: this article was revised on October 23, 2026 to remove claims we could not verify and to add sources.
Leave a Reply