Google Chrome Dawn WebGPU Use-After-Free Zero-Day Under Active Exploitation (CVE-2026-5281) — Threadlinqs Intelligence
As of 2026-05-30, Google Chrome Dawn WebGPU Use-After-Free Zero-Day Under Active Exploitation (CVE-2026-5281) is a critical-severity zero day threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-0321 · Severity: CRITICAL · CVSS: 8.8 · Status: PATCHED · Category: ZERO_DAY
Attribution: N/A · UNKNOWN
A use-after-free vulnerability (CWE-416) in Dawn, Chromium's WebGPU implementation, allows a remote attacker who has compromised the renderer process to execute arbitrary code and potentially escape
CVE-2026-5281 is a critical use-after-free (UAF) memory safety vulnerability in Dawn, Google's open-source cross-platform implementation of the WebGPU standard that serves as the abstraction layer between web applications calling WebGPU APIs and GPU hardware. Dawn translates graphics and compute instructions into platform-specific GPU calls: Vulkan on Linux, Metal on macOS, and Direct3D 12 on Windows.
The vulnerability stems from Dawn's object lifetime management pattern. The component relies on raw pointers to reference-counted objects while assuming external lifetime guarantees. As documented in Chromium's WebGPU research, WebGPU objects have lifetimes that span multiple layers of reference counting and raw pointers, creating conditions where stale pointers can persist. This manifests when objects are freed but references remain in queues (such as pending sets), and asynchronous execution occurs before later code accesses the freed memory, violating lifetime assumptions.
The exploit chain operates in a two-stage model. In stage one, an attacker must first compromise Chrome's renderer process through a separate vulnerability. In stage two, a crafted HTML page triggers the Dawn use-after-free, allowing the attacker to fill freed memory space with malicious code. The result is arbitrary code execution in the GPU process context, which runs at a higher privilege level than the sandboxed renderer process. This effectively provides a sandbox escape primitive, as Dawn provides a boundary-crossing path from the renderer process (sandboxed, untrusted) through the WebGPU API, Dawn Wire, and GPU process command buffer to Dawn Native and native graphics APIs.
Chromium's severity guidance classifies this vulnerability as high-severity because it bypasses sandbox boundaries, despite requiring prior renderer compromise. The vulnerability was reported by a pseudonymous researcher identified as _86ac1f1587b71893ed2ad792cd7dde32_, who had previously identified CVE-2026-4675 (heap buffer overflow in WebGL) and CVE-2026-4676 (another UAF in Dawn), both fixed on March 23, 2026. Additional Dawn use-after-free flaws CVE-2026-5284 and CVE-2026-5286 were patched in the same release.
Google confirmed active in-the-wild exploitation on March 31, 2026, and CISA added CVE-2026-5281 to the Known Exploited Vulnerabilities catalog on April 1, 2026, requiring Federal Civilian Executive Branch agencies to remediate by April 15, 2026. This represents the fourth actively exploited Chrome zero-day of 2026, following CVE-2026-2441 (CSS engine UAF, February), CVE-2026-3909 (Skia out-of-bounds write, March), and CVE-2026-3910 (V8 JavaScript engine flaw, March). The accelerating cadence of browser zero-days targeting graphics subsystems underscores that WebGPU remains premium attack surface due to performance demands, cross-platform complexity, and native code dependencies.
The release that patched CVE-2026-5281 addressed 21 total security fixes including memory safety issues across WebGL, WebCodecs, CSS, ANGLE, WebUSB, Web MIDI, V8, PDF handling, Navigation, and Compositing components. All Chromium-based browsers including Microsoft Edge, Brave, Opera, and Vivaldi are affected until they incorporate the upstream fixes.
Target sectors: government, financial, technology, defense, critical-infrastructure, healthcare, education, energy
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
ZERO_DAY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-5281, T1189, T1203, T1059, T1068, T1055, T1211, T1055, T1036, T1082, T1057