CVE-2026-5281
Published Apr 1, 2026
Last updated 3 months ago
- Description
- Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- Source
- chrome-cve-admin@google.com
- NVD status
- Analyzed
- Products
- chrome
CVSS 3.1
- Type
- Secondary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity
- HIGH
Data from CISA
- Vulnerability name
- Google Dawn Use-After-Free Vulnerability
- Exploit added on
- Apr 1, 2026
- Exploit action due
- Apr 15, 2026
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- chrome-cve-admin@google.com
- CWE-416
- Hype score
- Not currently trending
Google has patched 7 actively exploited Chrome zero-days so far in 2026: • CVE-2026-2441 • CVE-2026-3909 • CVE-2026-3910 • CVE-2026-5281 • CVE-2026-11645 • CVE-2026-85046 • CVE-2026-87491 ⚠️ Chrome updates automatically, but verify you’re on the latest versi
@0xShekhar
14 Sept 2026
45 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
I used CVE-2026-11057 to bypass the address randomization in CVE-2026-5281 and completed a fully working full-chain exploit that actually runs on Android. https://t.co/aSWUlG6RsI
@jakob21575
25 Aug 2026
38 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2026-5281: Use-after-free in Google Dawn (Chromium component) is on CISA KEV; remote code execution via crafted HTML after renderer compromise. What happened CISA added CVE-2026-5281 to the Known Exploited Vulnerabilities (KEV) catalog, signaling confirmed…
@lyrie_ai
15 May 2026
38 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
Top 5 Trending CVEs: 1 - CVE-2024-7399 2 - CVE-2023-50224 3 - CVE-2025-48700 4 - CVE-2025-20333 5 - CVE-2026-5281 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W
@CVEShield
25 Apr 2026
226 Impressions
0 Retweets
0 Likes
1 Bookmark
0 Replies
0 Quotes
Intel Report [CRITICAL] - Google Chrome and its underlying Chromium engine have been subject to a sustained wave of actively exploited zero-day vulnerabilities throughout 2025 and into early 2026. The most recent critical vulnerability, CVE-2026-5281,... https://t.co/3imobThyCB
@EnigmaGlobalSW
10 Apr 2026
47 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
"matchCriteriaId": "55B0324F-7911-403B-8235-D71996B55DFB",
"versionEndExcluding": "146.0.7680.177",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
"matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
]