Google Chrome Dawn WebGPU Use-After-Free Zero-Day Under Active Exploitation (CVE-2026-5281)
Google Chrome Dawn WebGPU Use-After-Free Zero-Day Under (TL-2026-0315), also tracked as Chrome Dawn WebGPU Zero-Day, is a high-severity zero-day vulnerability scored CVSS 8.8, first published 2026-04-04. It has no confirmed attribution, affects Google Chrome, references 1 CVE (CVE-2026-5281), maps to 12 MITRE ATT&CK techniques (T1005, T1027, T1055), and is covered by 9 detection rules and 14 indicators of compromise.
Key facts for TL-2026-0315
- Threat ID
- TL-2026-0315
- Also known as
- Chrome Dawn WebGPU Zero-Day, Chromium Issue 491518608
- Severity
- HIGH
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- ZERO_DAY
- First published
- 2026-04-04
- Last reviewed
- 2026-04-04
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- government, technology, financial, defense, media, telecommunications, education, healthcare
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Google Chrome Dawn WebGPU Use-After-Free Zero-Day Under
Malware and tooling: CVE-2026-5281 WebGPU Exploit
Active exploitation of a use-after-free vulnerability (CVE-2026-5281) in Google Chrome's Dawn WebGPU implementation enables remote code execution within the renderer process via crafted HTML pages. This is the fourth Chrome zero-day exploited in the wild in 2026. CISA added it to the KEV catalog on April 1, 2026 with an April 15 remediation deadline.
How Google Chrome Dawn WebGPU Use-After-Free Zero-Day Under works
CVE-2026-5281 is a high-severity use-after-free (CWE-416) memory corruption vulnerability in Dawn, Google's open-source cross-platform implementation of the WebGPU standard used in Chromium-based browsers. The flaw resides in Dawn's WebGPU command buffer queue and stems from inadequate synchronization during GPU object lifecycle management.
The root cause is a race condition triggered when JavaScript calls .destroy() on GPU buffer objects immediately after submission via gpuDevice.queue.submit(). The destruction deallocates memory without halting pending GPU operations, leaving dangling pointers in the asynchronous GPU task queue that persist during processing.
The exploitation chain proceeds as follows: (1) an attacker establishes a WebGPU context via HTMLCanvasElement, (2) allocates multiple GPU buffers and compute pipelines, (3) submits command buffers in rapid succession, (4) calls .destroy() on buffer objects to win the race condition, (5) performs heap spraying to reclaim freed memory with malicious payloads, and (6) achieves code execution when the queue processes the dangling pointers.
Critically, the official vulnerability description states the flaw 'allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.' This implies the Dawn UAF is likely used as a second stage in an exploit chain — a separate vulnerability first compromises the renderer, then CVE-2026-5281 escalates privileges, potentially escaping Chrome's sandbox entirely. Graphics components often bypass standard browser security boundaries, making this escalation path particularly dangerous.
The vulnerability affects all Chromium-based browsers including Google Chrome, Microsoft Edge, Opera, Brave, and Vivaldi across Windows (D3D12 backend), macOS (Metal backend), Linux (Vulkan backend), and ChromeOS. Google patched the flaw in Chrome 146.0.7680.177/178 released March 31, 2026 as part of an emergency update addressing 21 total vulnerabilities.
The same researcher who reported CVE-2026-5281 also reported three related vulnerabilities patched in the same timeframe: CVE-2026-4675 (heap buffer overflow in WebGL), CVE-2026-4676 (separate Dawn use-after-free with sandbox escape potential), and CVE-2026-5284 (third Dawn use-after-free). This cluster of GPU-layer bugs suggests systematic fuzzing or targeted research into Chrome's graphics subsystem.
CVE-2026-5281 is the fourth actively exploited Chrome zero-day of 2026, following CVE-2026-2441 (iterator invalidation in CSSFontFeatureValuesMap, February), CVE-2026-3909 (out-of-bounds write in Skia, March), and CVE-2026-3910 (inappropriate implementation in V8, March). This pace exceeds the eight total zero-days patched in all of 2025, indicating sustained adversary interest in browser exploitation.
MITRE ATT&CK techniques used in TL-2026-0315
collection
defense-evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1211 Exploitation for Stealth
privilege-escalation
T1068 Exploitation for Privilege Escalation
command-and-control
T1071 Application Layer Protocol
discovery
T1082 System Information Discovery
initial-access
execution
T1203 Exploitation for Client Execution; T1204 User Execution
resource-development
Affected products and versions in Google Chrome Dawn WebGPU Use-After-Free Zero-Day Under
- Google — Chrome
Vulnerable versions: All versions prior to 146.0.7680.178
Fixed in: 146.0.7680.177 (Linux); 146.0.7680.178 (Windows/macOS) - Microsoft — Edge
Vulnerable versions: All Chromium-based versions prior to 146.0.7680.178
Fixed in: 146.0.7680.178 - Opera Software — Opera
Vulnerable versions: Versions using Chromium prior to 146.0.7680.178
Fixed in: Pending vendor update - Brave Software — Brave Browser
Vulnerable versions: Versions using Chromium prior to 146.0.7680.178
Fixed in: Pending vendor update - Vivaldi Technologies — Vivaldi
Vulnerable versions: Versions using Chromium prior to 146.0.7680.178
Fixed in: Patched (confirmed deployed) - Google — Chromium
Vulnerable versions: All versions prior to 146.0.7680.178
Fixed in: 146.0.7680.178
Remediation for Google Chrome Dawn WebGPU Use-After-Free Zero-Day Under
Patches
- Google Chrome 146.0.7680.177 (Linux)
- Google Chrome 146.0.7680.177/178 (Windows/macOS)
- Microsoft Edge 146.0.7680.178 (all platforms)
- Chromium-based browsers: apply upstream Chromium patch for Dawn component
Immediate actions
- Update all Chromium-based browsers to Chrome 146.0.7680.178 or later immediately
- Update Microsoft Edge, Brave, Opera, and Vivaldi to patched versions incorporating the upstream fix
- Monitor browser fleet for unpatched instances using endpoint management tools
- Monitor for unusual GPU process crashes and elevated Device Lost API errors as exploitation indicators
Workarounds
- Disable WebGPU via Chrome enterprise policy (--disable-features=WebGPU) as interim mitigation
- Restrict WebGL and WebAssembly features via group policy for high-risk environments
- Implement network segmentation to limit lateral movement from compromised browser processes
- Block access to untrusted websites for users on unpatched systems
Longer-term hardening
- Deploy EDR/XDR with behavioral detection for browser exploitation patterns
- Implement browser isolation solutions for high-risk user populations
- Establish rapid browser patching SLAs (24-48 hours for actively exploited zero-days)
- Enable Chrome's Enhanced Safe Browsing for proactive threat detection
- Consider network-level inspection for anomalous WebGPU content delivery
CVEs associated with Google Chrome Dawn WebGPU Use-After-Free Zero-Day Under
Weaknesses (CWE) in Google Chrome Dawn WebGPU Use-After-Free Zero-Day Under
CWE-416
Timeline of Google Chrome Dawn WebGPU Use-After-Free Zero-Day Under
- Google patches CVE-2026-2441, the first Chrome zero-day of 2026 (iterator invalidation in CSSFontFeatureValuesMap), signaling increased browser targeting
- Google patches CVE-2026-4675 (heap buffer overflow in WebGL) and CVE-2026-4676 (Dawn UAF with sandbox escape potential), reported by the same researcher who found CVE-2026-5281
- CVE-2026-5281 reported to Google via Chromium Issue Tracker (Issue 491518608) by security researcher
- Google patches CVE-2026-3909 (Skia OOB write) and CVE-2026-3910 (V8 implementation flaw), the second and third Chrome zero-days of 2026
- Google releases emergency Chrome 146.0.7680.177/178 patching CVE-2026-5281 alongside 20 other vulnerabilities including CVE-2026-5284 (third Dawn UAF)
- Google confirms active exploitation in the wild: 'Google is aware that an exploit for CVE-2026-5281 exists in the wild'
- CISA adds CVE-2026-5281 to Known Exploited Vulnerabilities catalog under BOD 22-01, setting April 15 2026 remediation deadline for FCEB agencies
- Researcher toolkit and proof-of-concept published on GitHub, increasing risk of widespread exploitation
- CISA, NVD, and multiple security vendors publish advisories. CSA Singapore issues alert AL-2026-029. Vivaldi confirms fix deployed; Microsoft Edge patch in progress
- CISA KEV remediation deadline for Federal Civilian Executive Branch agencies under Binding Operational Directive 22-01
- As of 2026-05-29, CVE-2026-5281 (Chrome Dawn WebGPU UAF) is patched in Chrome 146.0.7680.178 (Mar 31, 2026) with the CISA KEV deadline (Apr 15) now passed and no post-patch resurgence reported. It remains unattributed with a public PoC toolkit, so unpatched Chromium-based fleets are still at risk; monitor patch compliance.
Sources cited for Google Chrome Dawn WebGPU Use-After-Free Zero-Day Under
- Chrome Stable Channel Update for Desktop - March 31 2026
- CISA Alert: Google Releases Security Updates for Chrome
- NVD Entry - CVE-2026-5281
- Chromium Bug Tracker - Issue 491518608
- BleepingComputer: Google Fixes Fourth Chrome Zero-Day Exploited in Attacks in 2026
- The Hacker News: New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation
- Help Net Security: Google Fixes Chrome Zero-Day with In-the-Wild Exploit
- Security Affairs: Google Fixes Fourth Actively Exploited Chrome Zero-Day of 2026
- CVE Reports: CVE-2026-5281 Technical Analysis
- CISA Known Exploited Vulnerabilities Catalog - CVE-2026-5281
- eSecurity Planet: Chrome Vulnerability CVE-2026-5281 Exploited in the Wild
- DarkWebInformer: Chrome Zero-Day CVE-2026-5281 - A Use-After-Free in Dawn WebGPU Layer
- Penligent: CVE-2026-5281 What Chrome Dawn Zero-Day Actually Means
- CSA Singapore: Active Exploitation of Zero-Day Vulnerability in Google Chrome
Threats related to Google Chrome Dawn WebGPU Use-After-Free Zero-Day Under
Detection coverage for TL-2026-0315
As of 2026-04-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0315 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.