Use‑After‑Free in Google Dawn (CVE‑2026‑5281) Actively Exploited, Threatening Federal and Enterprise Environments
What It Is – A use‑after‑free flaw in Google’s Dawn graphics library (CVE‑2026‑5281) allows an attacker to achieve arbitrary code execution. The vulnerability has been confirmed as actively exploited in the wild.
Exploitability – Public evidence of exploitation; proof‑of‑concept code is circulating. CVSS v3.1 score is 9.8 (Critical).
Affected Products – Google Dawn library, embedded in Chrome, Chrome‑based WebViews, and other Google‑powered rendering stacks used across cloud and on‑premise applications.
TPRM Impact – The flaw resides in a widely‑distributed third‑party component that many vendors embed in their SaaS, SaaS‑backed APIs, and internal tools. Compromise of Dawn can cascade to downstream customers, creating a supply‑chain risk for any organization that relies on Google‑based rendering services.
Recommended Actions –
- Prioritize patching of all systems that include the Dawn library (Chrome ≥ latest, Chrome‑based WebViews, and any bundled Google SDKs).
- Verify that third‑party SaaS providers have applied the upstream fix; request remediation timelines if not.
- Update vulnerability‑management policies to treat KEV‑listed CVEs as “must‑fix” within 30 days.
- Conduct targeted scanning for the CVE‑2026‑5281 fingerprint in internal assets.
Source: CISA Advisory – CISA Adds One Known Exploited Vulnerability to Catalog (2026‑04‑01)