CVE-2026-5281
Google Chrome Use-After-Free Vulnerability
Description
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
INFO
Published Date :
April 1, 2026, 5:16 a.m.
Last Modified :
April 1, 2026, 2:23 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Solution
- Update Google Chrome to version 146.0.7680.178 or later.
- Apply vendor patches when available.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-5281.
| URL | Resource |
|---|---|
| https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html | |
| https://issues.chromium.org/issues/491518608 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-5281 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-5281
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-5281 vulnerability anywhere in the article.
-
Daily CyberSecurity
ASUS Issues Security Patch for Router Vulnerability
In a move to fortify home and office networks, ASUS has released a security update for several of its router models. The update targets a high-severity vulnerability that could allow attackers to hija ... Read more
-
CybersecurityNews
New Chrome Zero-Day Vulnerability Actively Exploited in Attacks — Patch Now
Google has released an emergency security update for its Chrome browser, patching a zero-day vulnerability that is already being actively exploited in the wild. The Stable channel has been updated to ... Read more
-
Daily CyberSecurity
2 Million Monthly Users at Risk: Critical 9.3 CVSS SQL Injection Hits MikroORM in “Duck-Typed” Disaster
A critical vulnerability has been identified in MikroORM, a widely used TypeScript Object-Relational Mapper (ORM) for Node.js. With over 2 million downloads every month, the impact of this flaw could ... Read more
-
Help Net Security
Google fixes Chrome zero-day with in-the-wild exploit (CVE-2026-5281)
Google has fixed 21 vulnerabilities affecting its popular Chrome browser, among them a zero-day (CVE-2026-5281) with an in-the-wild exploit. About CVE-2026-5281 As per usual, information about the fix ... Read more
-
The Cyber Express
Google Chrome Update Fixes 21 Flaws, Warns of Actively Exploited Vulnerability
Google has released a Stable Channel Update for Chrome, addressing 21 security vulnerabilities, including a high-profile code smuggling vulnerability that is actively being exploited in the wild. The ... Read more
-
Daily CyberSecurity
NVIDIA Patches High-Severity “Insecure Deserialization” Flaws in BioNeMo Framework
NVIDIA has issued an important security update for its BioNeMo Framework, a critical tool used by researchers and developers in the generative AI and drug discovery space. The update addresses two hig ... Read more
-
Daily CyberSecurity
Steganography & Sabotage: Inside Pawn Storm’s PRISMEX Offensive Against NATO Logistics
The notorious Russia-aligned threat actor known as Pawn Storm (also recognized as APT28, Fancy Bear, and Forest Blizzard) has significantly escalated its cyber operations in early 2026. According to a ... Read more
-
Daily CyberSecurity
Exploited in the Wild: Google Issues Emergency Patch for Chrome Zero-Day (CVE-2026-5281) in Dawn Component
Google has released a critical security update for the Chrome Stable channel to address 21 security vulnerabilities. While the patch covers a wide array of flaws, one particular bug has put security t ... Read more
The following table lists the changes that have been made to the
CVE-2026-5281 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Apr. 01, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H -
New CVE Received by [email protected]
Apr. 01, 2026
Action Type Old Value New Value Added Description Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) Added CWE CWE-416 Added Reference https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html Added Reference https://issues.chromium.org/issues/491518608