Chrome Zero-Day CVE-2026-5281: Update Your Browser Now

Google has patched a critical actively exploited zero-day in Chrome—CVE-2026-5281—that allows attackers to execute malicious code on your device simply by visiting a compromised webpage. The vulnerability exists in Chrome’s Dawn engine, Google’s WebGPU implementation used for hardware-accelerated graphics. CISA added it to the Known Exploited Vulnerabilities catalog on April 1, 2026, with a mandatory federal remediation deadline of April 15. This is the 4th Chrome zero-day patched under active exploitation in 2026 alone. If you haven’t updated Chrome recently, stop and do it now.

What Is CVE-2026-5281? The Dawn WebGPU Vulnerability Explained

CVE-2026-5281 is a Use-After-Free (UAF) vulnerability in Chrome’s Dawn graphics engine—the component responsible for WebGPU rendering. A UAF flaw occurs when software references memory that has already been freed, allowing an attacker to inject and execute controlled data in that freed memory region.

In this case, Dawn’s graphics resource management layer fails to correctly track object lifetimes during WebGPU rendering operations. The attack chain works as follows: a malicious website delivers specialized WebGPU JavaScript that forces Chrome to prematurely release a graphics object; before Chrome marks that memory region invalid, the attacker’s code reuses the freed address to write controlled data—achieving arbitrary code execution within Chrome’s renderer process. From there, the exploit reportedly functions as a second-stage payload, chained after an initial renderer compromise to achieve full system access.

What makes this particularly dangerous: no user interaction beyond visiting the page is required. There is no malicious download, no plugin, no pop-up to click. Simply loading a weaponized website in an unpatched Chrome browser is sufficient for exploitation.

Which Chrome Versions Are Affected—and Which Is Safe

All Chrome versions below the patched release are vulnerable. Google’s fix is included in:

• Windows and macOS: Chrome 146.0.7680.177 / 146.0.7680.178
• Linux: Chrome 146.0.7680.177

This release also patches 20 additional vulnerabilities—bringing the total to 21 flaws fixed in a single update. Among them are two more UAF vulnerabilities in Dawn (CVE-2026-4676, CVE-2026-5284) and a WebGL heap buffer overflow (CVE-2026-4675). Chromium-based browsers including Microsoft Edge, Brave, Vivaldi, and Opera share the Dawn engine and are also affected—check each vendor’s advisory for their respective patched versions.

How to Update Chrome Right Now (Step-by-Step)

Updating Chrome takes under a minute. Here’s how to do it on each platform:

Windows / macOS:

1. Open Chrome
2. Click the three-dot menu (⋮) in the top-right corner
3. Go to Help > About Google Chrome
4. Chrome checks for updates automatically
5. Click "Relaunch" when the update is ready

Linux (Debian/Ubuntu):

sudo apt update && sudo apt upgrade google-chrome-stable

After updating, verify your version at chrome://settings/help. You should see 146.0.7680.177 or higher. If Chrome shows it is already up to date but the version number is lower than the patched release, force-quit Chrome completely and relaunch it—the update may be waiting for a restart.

Context: Chrome’s Zero-Day Problem in 2026

CVE-2026-5281 is the 4th Chrome zero-day patched under active exploitation since January 2026—roughly one per month. The previous three:

• CVE-2026-2441 (February 2026) — Use-After-Free in CSS rendering
• CVE-2026-3909 (March 2026) — Out-of-bounds write in Skia (CVSS 8.8)
• CVE-2026-3910 (March 2026) — V8 JavaScript engine flaw (CVSS 8.8)

This pattern reflects the growing sophistication of browser-based attacks—particularly targeting GPU and graphics APIs like WebGPU, which have expanded Chrome’s attack surface significantly as hardware acceleration has become standard. Security researchers have flagged WebGPU as a high-risk area for 2026 due to the complexity of managing GPU memory lifecycles across operating systems.

If you have not yet enabled Chrome’s automatic updates or are using a managed device where IT controls update timing, escalate this to your IT team immediately. For additional security hygiene beyond patching, see our guides on best free antivirus software and our broader security coverage for the latest threat advisories.

What Should You Do Right Now?

If you have not updated Chrome yet, the correct first action is to patch before you keep browsing. Zero-days matter because they collapse the normal buffer between disclosure and exploitation. The longer you wait, the more likely you are relying on luck rather than defense.

After updating, review the rest of your browser hygiene: remove extensions you no longer trust, restart all synced devices, and keep an eye on related alerts in our security hub. If you run Chrome in a work environment, pair this with basic endpoint and account checks rather than treating the patch as the only response.

Action	Priority	Why
Update Chrome immediately	Highest	Closes the actively exploited vulnerability first.
Restart browser and device	High	Ensures the patched version is actually running.
Review extensions and synced installs	Medium	Reduces follow-on risk if one device lags behind.

Common Questions — Chrome Zero-Day CVE-2026-5281

Common Questions — Chrome Zero-Day CVE-2026-5281

Q: Am I at risk if I haven’t updated Chrome?

A: Yes. CVE-2026-5281 is confirmed under active exploitation in the wild. If your Chrome version is below 146.0.7680.177, you are vulnerable. The attack requires no user interaction beyond visiting a malicious webpage—no download or click needed. Update Chrome immediately via the three-dot menu → Help → About Google Chrome.

Q: Does this affect other Chromium-based browsers like Edge or Brave?

A: Yes. Microsoft Edge, Brave, Vivaldi, Opera, and other Chromium-based browsers share the Dawn/WebGPU engine and are affected by the same class of vulnerability. Each vendor typically patches within days of Google’s release. Check each browser’s built-in “About” page or the vendor’s security advisory for the specific patched version number. Firefox is not affected by this particular flaw.

Q: Is there a workaround if I can’t update Chrome immediately?

A: No official workaround exists. If you absolutely cannot update, reduce risk by avoiding unfamiliar or untrusted websites, avoiding pages with heavy 3D or WebGPU content, and considering a temporary switch to Firefox for sensitive browsing. Endpoint detection tools may detect exploitation attempts. For enterprise environments, contact your IT department—CISA has mandated federal patching by April 15, 2026.

Q: How do I know if I was already exploited?

A: Signs of exploitation can include unexpected system behavior, unauthorized processes, or outgoing network connections to unknown addresses. Run a full scan with up-to-date endpoint security software. Chrome itself does not have built-in exploit detection. If you suspect compromise on a work device, contact your IT security team. For personal devices, running a reputable antivirus scan and reviewing recent browser activity is a reasonable first step.

Last Updated: April 13, 2026