New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation — Patch Released
Summary: Google released Chrome security updates addressing 21 vulnerabilities, including CVE-2026-5281, a high-severity use-after-free bug in Dawn, the open-source WebGPU implementation, which Google says has been exploited in the wild. The flaw allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page in Chrome versions prior to 146.0.7680.178, and CISA added it to its KEV catalog on April 1, 2026, with a federal fix deadline of April 15, 2026.
What you should know: This is the fourth actively weaponized Chrome zero-day Google has patched since the start of the year, and federal civilian agencies have until April 15, 2026 to apply the fix - a deadline that implies the same urgency for every organization running Chrome or a Chromium-based browser.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-2441CVE-2026-3909CVE-2026-3910CVE-2026-5281
- Related