CVE-2026-5281 – High‑Severity Use‑After‑Free in Google Chrome’s Dawn WebGPU Engine

Key Takeaways

CVE-2026-5281 is a High‑severity (CVSS 8.8) use‑after‑free in Chrome’s Dawn (WebGPU) component.

Actively exploited in the wild; listed in the CISA KEV catalog.

Affects all Chrome releases prior to Chrome 146.0.7680.178 on Windows, macOS, Linux.

Immediate patch via Chrome update is the only reliable mitigation.

Monitor for suspicious WebGPU activity and enforce rapid update policies.

Overview

The vulnerability identified as CVE-2026-5281 is a use‑after‑free bug in the Dawn implementation of WebGPU inside Google Chrome. The flaw allows an attacker who can deliver a crafted HTML page to a victim’s browser to execute arbitrary code on the host system. Google disclosed that the issue was actively exploited in the wild and added it to the CISA KEV catalog, prompting an urgent security update.

Technical Details

Dawn’s WebGPU stack allocates a DeviceInfo object that holds callbacks for GPU operations. When the object is destroyed, the code fails to clear pending callbacks, leaving a dangling pointer. A malicious page can trigger a sequence of WebGPU API calls that frees the DeviceInfo structure and then re‑uses the stale pointer, resulting in a classic CWE‑416 use‑after‑free. This memory corruption can be leveraged to achieve remote code execution (RCE) with the privileges of the compromised renderer process, effectively breaking out of Chrome’s sandbox.

The attack requires only a normal web page (no user interaction beyond loading) and can be delivered through drive‑by download techniques. Because the vulnerability lives in the GPU process, it can be chained with other sandbox‑escape bugs for full system compromise.

<!-- Pseudo‑code illustrating a WebGPU call sequence that may trigger the bug -->
<script>
  const adapter = await navigator.gpu.requestAdapter();
  const device = await adapter.requestDevice();
  // ... perform operations that allocate and free DeviceInfo ...
  // Malicious pattern leads to use‑after‑free
</script>

The snippet is for illustration only; no public exploit code is released.

Severity & Impact

CVSS v3.1: CVSS 8.8 (Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Impact: Remote code execution with high confidentiality, integrity, and availability impact.
Exploitability: Network‑accessible, low attack complexity, requires user to load a malicious page (UI:R).
CWE: CWE‑416 (Use‑After‑Free).

Affected Products

Vendor	Product	Fixed in
Google	Chrome (Windows/macOS/Linux)	Chrome 146.0.7680.178

For the complete list of affected versions and platforms, see the detailed VulnSocial CVE page.

Actionable Insights – What to Do

Patch immediately – Deploy Chrome 146.0.7680.178 or later across all endpoints.
Verify versions – Use chrome://settings/help or enterprise inventory tools to confirm the update.
Enforce rapid update policies – Configure auto‑update or use Chrome Enterprise policies to push the fix.
Temporarily mitigate – If patching cannot be done instantly, disable WebGPU via the flag chrome://flags/#enable-webgpu or set the enterprise policy WebGPUAllowed to false.
Monitor for indicators – Look for spikes in Chrome renderer crashes, unusual GPU process activity, or network traffic to WebGPU‑related domains. Integrate threat‑intel feeds that track active exploitation of CVE-2026-5281.
Leverage CISA alerts – Add the CISA KEV entry to your vulnerability management dashboard to prioritize remediation.

Remediation & Mitigation

Patch – Update Chrome to version 146.0.7680.178 or newer via the standard update channel or enterprise deployment tools.
Validate – After updating, confirm the version number on each system; remove any legacy Chrome binaries.
Hardening – Disable the WebGPU feature if it is not required for your environment:
```
# Chrome flag (temporary)
chrome --disable-features=WebGPU
```
Or set the enterprise policy WebGPUAllowed to false.
Detect – Enable detailed crash logging (chrome://crashes) and forward logs to a SIEM for anomaly detection.
Respond – If compromise is suspected, isolate the host, collect memory dumps of the Chrome processes, and conduct forensic analysis for malicious WebGPU payloads.

References

Chrome stable channel update (patch details): https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html
Chromium issue tracker (technical discussion): https://issues.chromium.org/issues/491518608
CISA Known Exploited Vulnerabilities Catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5281
Real‑time threat intelligence and signal timeline: https://vulnsocial.com/cve/CVE-2026-5281

Bottom Line

CVE-2026-5281 is a high‑severity, actively exploited use‑after‑free in Chrome’s Dawn WebGPU engine. The vulnerability is already being leveraged in the wild and is listed in the CISA KEV catalog. Apply the Chrome 146.0.7680.178 patch immediately and enforce strict update controls to protect your users.

#CVE #CVE20265281 #High #RCE #Chrome #WebGPU #CISAKEV #PatchNow