Zero-Day Use-After-Free in Chrome (CVE‑2026‑5281) Exploited In‑the‑Wild Threatens WebGPU Rendering
What It Is — A use‑after‑free (UAF) vulnerability in Dawn, the open‑source WebGPU implementation used by Chromium, that lets a remote attacker execute arbitrary code via a crafted HTML page. Google released a patch in Chrome 146.0.7680.177/178.
Exploitability — An active, in‑the‑wild exploit has been reported; no public PoC is available. CVSS v3.1 base score 9.8 (Critical).
Affected Products — Google Chrome (Windows, macOS, Linux) versions prior to 146.0.7680.177/178; Chromium‑based browsers such as Vivaldi (already patched) and Microsoft Edge (patch pending).
TPRM Impact — Any third‑party SaaS, internal web‑apps, or managed‑service platforms that rely on Chromium for rendering or sandboxing are exposed to remote code execution, potentially compromising confidential data and downstream supply‑chain services.
Recommended Actions —
- Enforce immediate update to Chrome 146.0.7680.177 or later on all corporate endpoints.
- Enable mandatory auto‑updates and require a browser restart after patch deployment.
- Verify that all Chromium‑based tools used by vendors (e.g., Vivaldi, Edge, custom Electron apps) are patched.
- Conduct a rapid scan for malicious HTML/JavaScript payloads in web applications and email gateways.
- Update TPRM risk registers to reflect a new zero‑day exposure and reassess vendor‑related browser‑security controls.
Source: Help Net Security