Active Exploitation Alert: Google Chrome Zero-Day CVE-2026-5281 Actively Exploited via Dawn WebGPU – Urgent Patch Required

Executive Summary

On March 31, 2026, Google released a critical security update for Chrome, addressing 21 vulnerabilities, including a high-severity zero-day, CVE-2026-5281, that was actively exploited in the wild. This marks the fifth zero-day vulnerability in Chrome exploited in 2026, underscoring the persistent targeting of widely used browsers by advanced threat actors. The vulnerability is a use-after-free (UAF) flaw in Dawn, the open-source WebGPU implementation leveraged by Chromium and all Chromium-based browsers. Successful exploitation allows remote code execution when a user visits a malicious HTML page, potentially enabling attackers to gain control over affected systems. The vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, highlighting its criticality and the urgency for immediate remediation.

Threat Actor Profile

While no specific advanced persistent threat (APT) group or cybercriminal syndicate has been publicly attributed to the exploitation of CVE-2026-5281, the use of zero-day vulnerabilities in Chrome is a hallmark of sophisticated actors. Historically, such exploits have been leveraged by state-sponsored groups, including those linked to cyber-espionage campaigns targeting government, technology, and enterprise sectors. The rapid weaponization and deployment of this vulnerability in the wild suggest a high level of technical capability and access to exploit development resources. The bug was reported by a pseudonymous security researcher, 86ac1f1587b71893ed2ad792cd7dde32, who has previously disclosed other critical vulnerabilities in Chrome, indicating either targeted vulnerability research or participation in bug bounty programs. The lack of public proof-of-concept (PoC) code at the time of writing suggests that exploitation is currently limited to well-resourced actors rather than widespread commodity malware campaigns.

Technical Analysis of Malware/TTPs

CVE-2026-5281 is a use-after-free vulnerability in the Dawn component, which implements the WebGPU API in Chromium. Use-after-free bugs occur when a program continues to use a memory location after it has been freed, leading to undefined behavior, memory corruption, and, in this case, the potential for arbitrary code execution. The vulnerability can be triggered remotely by enticing a user to visit a specially crafted HTML page that exploits the flaw in the Dawn renderer process. Once exploited, the attacker can execute code with the privileges of the browser process, bypassing sandboxing and other security controls if chained with additional vulnerabilities.

The technical exploitation chain likely involves heap manipulation to control the freed memory region, followed by the injection of malicious code. The attack vector aligns with the MITRE ATT&CK techniques T1203 (Exploitation for Client Execution) and T1189 (Drive-by Compromise), as adversaries exploit client-side software vulnerabilities via web content. The absence of detailed IOCs or exploit samples in public repositories indicates that the exploit is being used in targeted attacks rather than broad-based campaigns.

Exploitation in the Wild

Exploitation of CVE-2026-5281 has been confirmed by both Google and CISA, with active attacks observed prior to the public disclosure and patch release. The primary attack vector involves malicious HTML pages that trigger the UAF condition in the Dawn component, leading to code execution within the browser's renderer process. All major platforms—Windows, macOS, and Linux—running vulnerable versions of Chrome and other Chromium-based browsers are at risk. While no public PoC or exploit kit has been released, the confirmed exploitation in the wild and the rapid response from vendors and government agencies underscore the severity of the threat.

The exploitation is consistent with previous zero-day attacks against Chrome, where threat actors leverage browser vulnerabilities for initial access, surveillance, or lateral movement within targeted environments. The lack of detailed telemetry on victimology suggests that attacks may be highly targeted, focusing on high-value individuals or organizations.

Victimology and Targeting

At the time of this report, there is no public information attributing exploitation of CVE-2026-5281 to specific sectors, organizations, or countries. However, the historical targeting patterns for Chrome zero-days indicate a focus on government agencies, technology firms, financial institutions, and enterprises with valuable intellectual property or sensitive data. The inclusion of the vulnerability in the CISA KEV catalog and the requirement for federal agencies to patch by April 15, 2026, highlight the potential risk to critical infrastructure and regulated sectors. Organizations with high exposure to web-based threats, such as those with large remote workforces or public-facing web assets, should consider themselves at elevated risk.

Mitigation and Countermeasures

Immediate action is required to mitigate the risk posed by CVE-2026-5281. All users and organizations should update Google Chrome to version 146.0.7680.177/178 or later on Windows and macOS, and to 146.0.7680.177 or later on Linux. After updating, it is essential to restart the browser to ensure the patch is fully applied. Administrators should also monitor for updates from other Chromium-based browsers such as Microsoft Edge, Vivaldi, and Brave, as these may also be affected if not yet patched.

Organizations should review their patch management processes to ensure timely deployment of browser updates across all endpoints. Security teams are advised to monitor for unusual browser crashes, anomalous WebGPU or Dawn activity, and signs of exploitation attempts targeting outdated browser versions. Where possible, implement network controls to restrict access to untrusted web content and consider deploying browser isolation technologies for high-risk users.

For regulated sectors, compliance with CISA KEV guidance is mandatory, and organizations should document their remediation efforts accordingly. Regular user awareness training on the risks of visiting unknown or suspicious websites can further reduce the likelihood of successful exploitation.

References

About Rescana

Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to assess, monitor, and mitigate cyber risks across their digital supply chain. Our advanced threat intelligence and automation capabilities empower security teams to proactively identify vulnerabilities, streamline remediation, and ensure compliance with industry standards. For more information about how Rescana can help strengthen your organization's cyber resilience, or for any questions regarding this advisory, please contact us at ops@rescana.com.