What is CVE-2026-5281?
Critical use-after-free memory safety vulnerability in Dawn, Google's open-source cross-platform WebGPU implementation used in Chromium-based browsers. The flaw resides in Dawn's WebGPU command buffer queue and stems from inadequate synchronization during GPU object lifecycle management. A race condition is triggered when JavaScript calls .destroy() on GPU buffer objects immediately after submission via gpuDevice.queue.submit(), deallocating memory without halting pending GPU operations, leaving dangling pointers in the asynchronous GPU task queue. The exploit chain operates in a two-stage model: an attacker first compromises Chrome's renderer process through a separate vulnerability, then a crafted HTML page triggers the Dawn use-after-free to fill freed memory with malicious code, achieving arbitrary code execution in the GPU process context at higher privilege than the sandboxed renderer — effectively a sandbox escape. The vulnerability was confirmed under active in-the-wild exploitation on March 31, 2026 and represents the fourth actively exploited Chrome zero-day of 2026, following CVE-2026-2441 (CSS engine UAF, February), CVE-2026-3909 (Skia OOB write, March), and CVE-2026-3910 (V8 flaw, March). CISA added it to the KEV catalog on April 1, 2026 with a remediation deadline of April 15, 2026. Patched in Chrome 146.0.7680.177/178 as part of an emergency update addressing 21 total vulnerabilities. All Chromium-based browsers including Edge, Brave, Opera, and Vivaldi were affected.
The record classifies CVE-2026-5281 under weakness class CWE-416. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs a user to take an action first, and has high impact on confidentiality, integrity, availability. 5 affected-product entries are recorded, across 5 vendors, listed below. The identifier was first published 210 days ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 8.8 — HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS (FIRST)
- 0.7% probability of exploitation in the next 30 days, higher than 51.8% of all scored CVEs
- CISA KEV
- Listed since 2026-04-01, federal remediation deadline 2026-04-15
- Threadlinqs priority
- 9/10 — CISA KEV-listed, which Threadlinqs floors at 9
- Published
- 2026-04-01, last modified 2026-04-02
Is CVE-2026-5281 being exploited?
CISA added CVE-2026-5281 to the Known Exploited Vulnerabilities catalog on 2026-04-01, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2026-04-15 under BOD 22-01. Weaponised exploit code for CVE-2026-5281 is publicly available. 5 public proof-of-concept repositories are tracked for this identifier. It currently carries a trending score of 41 in the Threadlinqs vulnerability feed.
- umair-aziz025/CVE-2026-5281-Research-Toolkit (github)
- TheMalwareGuardian/CVE-2026-5281 (github)
- jaf0rk/CVE-2026-5281 (github)
- jaf0rk/CVE-2026-5281-CVE-2026-11057-fullchain (github)
- trickest/cve (trickest)
Affected products and versions
How to fix CVE-2026-5281
The record marks a vendor fix as available for CVE-2026-5281. Patch reference: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html. Vendor advisory: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html. Because CVE-2026-5281 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2026-04-15. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.
Threat activity tracking CVE-2026-5281
3 tracked threats in the Threadlinqs corpus reference CVE-2026-5281, either in the campaign’s CVE list or as an indicator on the campaign record.
- Google Chrome V8 Out-of-Bounds Read/Write Zero-Day CVE-2026-11645 Exploited in the Wild — HIGH · 2026-06-09
- Google Chrome Dawn WebGPU Use-After-Free Zero-Day Under Active Exploitation (CVE-2026-5281) — CRITICAL · 2026-04-06
- Google Chrome Dawn WebGPU Use-After-Free Zero-Day Under Active Exploitation (CVE-2026-5281) — HIGH · 2026-04-04
Sources
Enriched from CVE.org, NVD, FIRST EPSS, CISA KEV, public proof-of-concept repositories. Last verified by Threadlinqs on . This product uses the NVD API but is not endorsed or certified by the NVD.
Other references
- chromereleases.googleblog.com
- issues.chromium.org
- nvd.nist.gov
- cisa.gov
- cisa.gov (cisa adds one known exploited vulnerabil)
Showing 5 of 15 recorded references.