Actively Exploited Chrome Zero‑Day (CVE‑2026‑5281) in WebGPU Dawn Component Fixed by Google
What It Is – Google disclosed a use‑after‑free vulnerability (CVE‑2026‑5281) in Chrome’s WebGPU Dawn graphics engine. The flaw allows remote code execution when malicious content is rendered.
Exploitability – The bug is confirmed to be exploited in the wild; attackers are already leveraging it to execute arbitrary code. Google issued an emergency patch (Chrome 146.0.7680.177/178).
Affected Products – Google Chrome (Windows, macOS, Linux) versions prior to 146.0.7680.177. The vulnerability resides in the Dawn component of the WebGPU API, used by web‑based graphics and gaming applications.
TPRM Impact –
- Corporate endpoints that browse the web or run Chrome‑based web‑apps are exposed to remote code execution, potentially compromising internal data.
- SaaS platforms that embed Chrome for rendering (e.g., headless browsers, PDF generators) inherit the risk, creating a supply‑chain vector.
Recommended Actions –
- Deploy the Chrome 146.0.7680.177 update across all managed devices immediately.
- Enforce automatic browser updates via enterprise policies.
- Review any internal services that embed Chrome (headless, automation, rendering) and verify they are patched.
- Conduct a short‑term scan for indicators of compromise related to known Chrome‑exploit payloads.
- Update threat‑intel feeds and alert SOC analysts to monitor for exploitation attempts.
Source: SecurityAffairs – Google fixes fourth actively exploited Chrome zero‑day of 2026