# Google Chrome Dawn WebGPU Use-After-Free Zero-Day Under Active Exploitation (CVE-2026-5281)

> Active exploitation of a use-after-free vulnerability (CVE-2026-5281) in Google Chrome's Dawn WebGPU implementation enables remote code execution within the renderer process via crafted HTML pages. This is the fourth Chrome zero-day exploited in the wild in 2026. CISA added it to the KEV catalog on April 1, 2026 with an April 15 remediation deadline.

- **Published:** 2026-04-04T12:00:00Z
- **Last reviewed:** 2026-04-04T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0315
- **ID:** TL-2026-0315
- **Severity:** HIGH (CVSS 8.8)
- **Category:** ZERO_DAY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-5281

## Description

CVE-2026-5281 is a high-severity use-after-free (CWE-416) memory corruption vulnerability in Dawn, Google's open-source cross-platform implementation of the WebGPU standard used in Chromium-based browsers. The flaw resides in Dawn's WebGPU command buffer queue and stems from inadequate synchronization during GPU object lifecycle management.

The root cause is a race condition triggered when JavaScript calls .destroy() on GPU buffer objects immediately after submission via gpuDevice.queue.submit(). The destruction deallocates memory without halting pending GPU operations, leaving dangling pointers in the asynchronous GPU task queue that persist during processing.

The exploitation chain proceeds as follows: (1) an attacker establishes a WebGPU context via HTMLCanvasElement, (2) allocates multiple GPU buffers and compute pipelines, (3) submits command buffers in rapid succession, (4) calls .destroy() on buffer objects to win the race condition, (5) performs heap spraying to reclaim freed memory with malicious payloads, and (6) achieves code execution when the queue processes the dangling pointers.

Critically, the official vulnerability description states the flaw 'allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.' This implies the Dawn UAF is likely used as a second stage in an exploit chain — a separate vulnerability first compromises the renderer, then CVE-2026-5281 escalates privileges, potentially escaping Chrome's sandbox entirely. Graphics components often bypass standard browser security boundaries, making this escalation path particularly dangerous.

The vulnerability affects all Chromium-based browsers including Google Chrome, Microsoft Edge, Opera, Brave, and Vivaldi across Windows (D3D12 backend), macOS (Metal backend), Linux (Vulkan backend), and ChromeOS. Google patched the flaw in Chrome 146.0.7680.177/178 released March 31, 2026 as part of an emergency update addressing 21 total vulnerabilities.

The same researcher who reported CVE-2026-5281 also reported three related vulnerabilities patched in the same timeframe: CVE-2026-4675 (heap buffer overflow in WebGL), CVE-2026-4676 (separate Dawn use-after-free with sandbox escape potential), and CVE-2026-5284 (third Dawn use-after-free). This cluster of GPU-layer bugs suggests systematic fuzzing or targeted research into Chrome's graphics subsystem.

CVE-2026-5281 is the fourth actively exploited Chrome zero-day of 2026, following CVE-2026-2441 (iterator invalidation in CSSFontFeatureValuesMap, February), CVE-2026-3909 (out-of-bounds write in Skia, March), and CVE-2026-3910 (inappropriate implementation in V8, March). This pace exceeds the eight total zero-days patched in all of 2025, indicating sustained adversary interest in browser exploitation.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1068 Exploitation for Privilege Escalation
- T1055 Process Injection
- T1211 Exploitation for Stealth
- T1027 Obfuscated Files or Information
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1587 Develop Capabilities
- T1608 Stage Capabilities

## Sources

- [Chrome Stable Channel Update for Desktop - March 31 2026](https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html)
- [CISA Alert: Google Releases Security Updates for Chrome](https://www.cisa.gov/news-events/alerts/2026/04/02/google-releases-security-updates-chrome)
- [NVD Entry - CVE-2026-5281](https://nvd.nist.gov/vuln/detail/CVE-2026-5281)
- [Chromium Bug Tracker - Issue 491518608](https://issues.chromium.org/issues/491518608)
- [BleepingComputer: Google Fixes Fourth Chrome Zero-Day Exploited in Attacks in 2026](https://www.bleepingcomputer.com/news/security/google-fixes-fourth-chrome-zero-day-exploited-in-attacks-in-2026/)
- [The Hacker News: New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation](https://thehackernews.com/2026/04/new-chrome-zero-day-cve-2026-5281-under.html)
- [Help Net Security: Google Fixes Chrome Zero-Day with In-the-Wild Exploit](https://www.helpnetsecurity.com/2026/04/01/google-chrome-zero-day-cve-2026-5281/)
- [Security Affairs: Google Fixes Fourth Actively Exploited Chrome Zero-Day of 2026](https://securityaffairs.com/190265/hacking/google-fixes-fourth-actively-exploited-chrome-zero-day-of-2026.html)
- [CVE Reports: CVE-2026-5281 Technical Analysis](https://cvereports.com/reports/CVE-2026-5281)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-5281](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [eSecurity Planet: Chrome Vulnerability CVE-2026-5281 Exploited in the Wild](https://www.esecurityplanet.com/threats/chrome-vulnerability-cve-2026-5281-exploited-in-the-wild/)
- [DarkWebInformer: Chrome Zero-Day CVE-2026-5281 - A Use-After-Free in Dawn WebGPU Layer](https://darkwebinformer.com/chrome-zero-day-cve-2026-5281-a-use-after-free-in-dawns-webgpu-layer/)
- [Penligent: CVE-2026-5281 What Chrome Dawn Zero-Day Actually Means](https://www.penligent.ai/hackinglabs/cve-2026-5281-what-chromes-dawn-zero-day-actually-means/)
- [CSA Singapore: Active Exploitation of Zero-Day Vulnerability in Google Chrome](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-029/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0315