Zero‑Day Use‑After‑Free in Google Dawn (CVE‑2026‑5281) Threatens Chromium‑Based Browsers
What It Is – A use‑after‑free vulnerability in the Dawn (WebGPU) component of Google Chrome (CVE‑2026‑5281) allows remote code execution when a malicious HTML page is rendered. The flaw scores 8.8 on the CVSS v3.1 scale, indicating a high‑severity issue.
Exploitability – The vulnerability is actively exploited in the wild; CISA has placed it in its Known Exploited Vulnerabilities (KEV) catalog and issued a binding directive for federal agencies to remediate by 15 April 2026.
Affected Products – Google Chrome < 146.0.7680.178 and any Chromium‑based browsers that embed the Dawn component, including Microsoft Edge and Opera, across Windows, macOS, and Linux platforms.
TPRM Impact – Because browsers are ubiquitous in enterprise environments, a compromised endpoint can become a launchpad for lateral movement, data exfiltration, or supply‑chain attacks on downstream SaaS services.
Recommended Actions –
- Deploy the Chrome 146.0.7680.177/178 update (or later) across all endpoints immediately.
- Verify that automatic patching is enabled for all Chromium‑based browsers.
- Conduct a rapid inventory of browsers in use and prioritize remediation for high‑risk user groups.
- Review CISA’s KEV guidance and ensure compliance with BOD 22‑01 deadlines.
- Monitor endpoint detection platforms for indicators of exploitation (e.g., anomalous WebGPU activity).
Source: SecurityAffairs