-
Cve 2026 5281 Cisa, CVE-2026-7473 CVE-2026-5281 is an actively exploited Chrome vulnerability in Dawn, Chromium’s WebGPU implementation. This deep dive explains what Google, NVD, and CISA actually confirm, . CVE-2026-5281 is Chrome's 4th zero-day of 2026 — a use-after-free in the Dawn/WebGPU component confirmed exploited in attacks. Federal Civilian Executive Google has fixed 21 vulnerabilities affecting its popular Chrome browser, among them a zero-day (CVE-2026-5281) with an in-the-wild exploit. Google fixes fourth actively exploited Chrome zero-day of 2026 Google fixed a new Chrome zero-day, tracked as CVE-2026-5281, in the WebGPU Dawn component that is already exploited in On April 1, 2026, Google released a Chrome security update addressing 21 vulnerabilities, one of which, CVE-2026-5281, was already being actively exploited in the wild at the time of disclosure. On April 1, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-5281 to their Known Exploited Vulnerabilities (KEV) Database. The headline fix is CVE-2026-5281, a use-after-free in Dawn, the open-source, cross-platform library that EU Vulnerability Database (EUVD) - the official EU repository for timely, curated cybersecurity vulnerability intelligence and remediation guidance. The fourth Chrome zero-day NIST is changing the way it handles cybersecurity vulnerabilities and exposures, or CVEs, listed in its National Vulnerabilit The CISA KEV catalogue added CVE-2026-5281 on 1 April 2026, with a remediation due date for federal agencies of 15 April 2026. The vulnerability in WebGPU allows renderer escape, the exact mechanism commercial spyware Detailed threat intelligence for CVE-2026-5281: Google Dawn Use-After-Free Vulnerability. The following products are affected by CVE-2026-5281 vulnerability. The company has confirmed exploitation in the wild, and CISA alerts users to Chrome zero-day CVE-2026-5281 actively exploited in attacks, impacting Chromium browsers and posing serious risks to users worldwide. , a V8 bug, CVE-2026-5281 Research Toolkit Chrome WebGPU Use-After-Free (CWE-416) This toolkit is for security research and defensive verification around CVE-2026-5281 Patched Chrome version: CVE-2026-5281 is a use after free vulnerability in Google Chrome Dawn. CVE-2026-48907 Mar 31, 2026 at 12:36 PM / Chrome Releases CVE Assignment NVD published the first details for CVE-2026-5281 Mar 31, 2026 at 10:16 PM Vendor Advisory GitHub Advisories released a security advisory. This week, Google For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative CISA’s April 1 update is a reminder that the Known Exploited Vulnerabilities Catalog remains one of the most operationally important signals in federal cybersecurity. Potentially, other Chromium-based browsers may be CVE-2026-5281 is an actively exploited Chrome vulnerability in Dawn, Chromium’s WebGPU implementation. The NVD CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CISA KEV listed. 6 CVSS — a full sandbox escape. A critical Chrome zero-day, CVE-2026-5281 in the WebGPU/Dawn graphics layer, is being actively exploited in 2026. Learn what CVE-2026-5281 means for your security, who is CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. It is an actively exploited use-after-free in Chrome's Dawn WebGPU layer that functions as a second-stage exploit, pointing to a This means CVE-2026-5281 is a sandbox escape -- it is the second stage of an exploit chain, not the initial entry point. 7680. It allows remote attackers to execute arbitrary code via a crafted HTML CVE-2026-5281 is a use-after-free in Dawn (Chromium’s graphics layer/WebGPU) affecting Google Chrome versions prior to 146. Update Chrome to version 146. Apply mitigations per vendor instructions, follow applicable BOD 22-01 For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative Vulnerability detail for CVE-2026-5281 Notice: Expanded keyword searching of CVE Records (with limitations) is now available in the search box above. The first stage would be a renderer compromise (e. Even if cvefeed. CVE-2026-5281 is a critical security concern because it is actively being exploited in the wild, as evidenced by its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. The entry concerns Google Dawn, an open-source WebGPU implementation utilised in Chromium CISA has added a newly exploited Chrome vulnerability, CVE-2026-5281, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to address it by April 15, 2026. Federal agencies are required to CISA has added CVE-2026-5281 to its Known Exploited Vulnerabilities (KEV) catalogue. CVE-2026-5281: Critical use-after-free in Chrome Dawn component actively exploited per CISA KEV. More than 150 million people use GitHub to discover, fork, and contribute to over 420 million projects. CISA added CVE-2026-5281 to its Known Exploited Vulnerabilities catalog and set a Google warns that CVE-2026-5281 is currently being exploited in the wild. g. A remote attacker who has gained control of the renderer Vulnerability detail for CVE-2026-5281 Notice: Expanded keyword searching of CVE Records (with limitations) is now available in the search box above. Google patched CVE-2026-5281, a high-severity use-after-free vulnerability in Dawn, Chromium’s WebGPU implementation, and it has confirmed exploitation in the wild. Learn more here. Google released an emergency update on March 31, and US CISA CVE-2026-5281 is not a simple browse-and-own vulnerability. However, the confirmed active exploitation of CVE-2026-5281 makes it a high-priority threat for security teams worldwide. It allows remote attackers to execute arbitrary code via a crafted HTML The agency says it has added CVE-2026-5281, described as a Google Dawn use-after-free vulnerability, based on evidence of active exploitation. io is aware of the exact versions of the products that are affected, the information is not represented in the CVE-2026-5281 is an actively exploited Chrome vulnerability in Dawn, Chromium’s WebGPU implementation. The purpose of this Alert is to provide resources for Zero-day 4 (April 2026, CVE-2026-5281): Dawn WebGPU use-after-free — actively exploited, CISA KEV listed Four zero-days in 91 days is not a Chrome-specific failure — it reflects the intensity of security CISA alerts users to Chrome zero-day CVE-2026-5281 actively exploited in attacks, impacting Chromium browsers and posing serious risks to users worldwide. Stay ahead of potential threats with the latest security updates from SUSE. The primary CVE-2026-5281 is an actively exploited Chrome vulnerability in Dawn, Chromium’s WebGPU implementation. 178+ on all platforms immediately. The Cyber Centre encourages users and Use after free in Dawn in Google Chrome prior to 146. This type of vulnerability is a frequent attack vector for Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements. Three What the Chrome zero-day CVE-2026-5281 is and how it works The vulnerability CVE-2026-5281 is rated as a high-severity use-after-free bug in Dawn, the open-source, cross‑platform Google patched two other Chrome zero-day bugs exploited in attacks earlier this month: the first is an out-of-bounds write weakness in the Skia 2D Google patched two other Chrome zero-day bugs exploited in attacks earlier this month: the first is an out-of-bounds write weakness in the Skia 2D According to Fortinet, on Jan. CONFIRMED: This vulnerability is under active Fiche complète pour CVE-2026-5281 : description technique, impact, score CVSS/EPSS, CWE, CAPEC, CPE affectés, date de publication, surface d’attaque et correctifs. The entry concerns Google Dawn, an open-source WebGPU implementation utilised in Chromium-based The Cybersecurity and Infrastructure Security Agency (CISA) has added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on January 22, 2026, signaling Last month, CISA warned federal agencies to patch another LiteSpeed cPanel vulnerability (CVE-2026-48172), which unauthenticated attackers exploited to execute arbitrary scripts with root Update May 14, 2026: CISA has updated this Alert to include additional vulnerabilities, CVE-2026-20133 and CVE-2026-20182 and associated resources. CISA added it to KEV with an Learn about Google's critical patch for Chrome's CVE-2026-5281 vulnerability and its implications for developers, security teams, and businesses. CISA officially added CVE-2026-5281 to Google patched CVE-2026-5281, the fourth actively exploited Chrome zero-day of 2026. This deep dive explains what Google, NVD, and CISA actually confirm, ThreatClaw assigns CVE-2026-5281 an exploitation risk score of 62/100 with high confidence. CISA has confirmed active exploitation of a critical zero-day vulnerability in Chromium-based browsers like Chrome and Edge. 178. Based on the description, it is inferred that the attack vector is remote content delivered via a malicious web page The flaw, officially tracked as CVE-2026-5281, has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog following confirmed reports of active exploitation by threat actors. According to CISA, the vulnerability could affect multiple CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-5281 as being exploited but is not known by the CISA to be used in ransomware campaigns. The NVD Google patched CVE-2026-5281, a high-severity use-after-free vulnerability in Dawn, Chromium’s WebGPU implementation, and it has confirmed exploitation in the wild. CVE-2026-5281 Published on April 1, 2026 Use after free in Dawn in Google Chrome prior to 146. CISA Alerts on Actively Exploited Chrome 0-Day Severity High Analysis Summary A critical zero-day vulnerability, tracked as CVE-2026-5281, has been discovered in Google Chrome, Introduction A newly discovered Chrome zero-day CVE-2026-5281 is currently under active exploitation, making it one of the most critical browser security threats of 2026. This deep dive explains what Google, NVD, and CISA actually confirm, CVE-2026-5281 is a High severity vulnerability (CVSS 8. This deep dive explains what Google, NVD, and CISA actually confirm, CISA CVE-2026-5289 scored a 9. A high-severity use-after-free vulnerability (CVE-2026-5281) exists in the underlying Chromium engine used by Microsoft Edge. 177 immediately to fix this high-severity flaw. At this time, CISA notes that it is currently unknown whether ransomware gangs have incorporated this specific exploit into their attack campaigns. CVE-2026-20131 According to CISA, this vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera. NOTICE — Understand the critical aspects of CVE-2026-5281 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance. Threat advisory on CVE-2026-5281, a use-after-free zero-day in Chrome's Dawn/WebGPU component actively exploited before the March 31, 2026 patch. The entry is listed in the CISA KEV catalog, confirming real‑world attacks. Google released an emergency Chrome update fixing CVE-2026-5281, the fourth actively exploited zero-day vulnerability discovered this year. Google has released Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common On April 1, 2026, Google pushed an out-of-band update to Chrome's Stable Desktop channel. 米サイバーセキュリティインフラストラクチャセキュリティ庁（CISA）は2026年4月1日、グラフィックスライブラリ「Dawn」に判明した脆弱性「CVE-2026 米サイバーセキュリティインフラストラクチャセキュリティ庁（CISA）は2026年4月1日、グラフィックスライブラリ「Dawn」に判明した脆弱性「CVE-2026 CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. An official website of the United States government Here's how you know CVE-2026-5281 Disclosure Date: April 01, 2026 •Last updated April 01, 2026 CVE-2026-5281 Exploited in the Wild Reported by AttackerKB Worker View Source Details Spread the loveIn a significant development for internet security, Google has announced the patching of 21 vulnerabilities in its Chrome browser, one of which, CVE-2026-5281, is a zero-day exploit CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. Based on the description, it is inferred that the attack vector is remote content delivered via a malicious web page Tracked as CVE-2026-5281, the use-after-free defect in the Dawn component of Google Chrome prior to 146. Learn about its impact, affected versions, and mitigation methods. NOTICE — The entry is listed in the CISA KEV catalog, confirming real‑world attacks. CVE-2026-5281 is a critical Use-After-Free (UAF) vulnerability located in the Dawn WebGPU backend of Chromium-based browsers. 0. 178 allowed a remote attacker who had compromised the renderer process to execute GitHub is where people build software. CVE-2008-4250 CISA has added CVE-2026-5281 to its Known Exploited Vulnerabilities (KEV) catalogue. 27, 2026, with What’s in this briefing: - CISA added CVE-2026-5281 (Google Dawn use-after-free) to the Known Exploited Vulnerabilities (KEV) Catalog after evidence of active exploitation. 8. 178 allowed a remote attacker who had compromised the renderer Web Technologies, Supply Chain & Dependencies Google Dawn contains a use-after-free vulnerability (CVE-2026-5281) that allows remote attackers who have compromised the renderer Web Technologies, Supply Chain & Dependencies Google Dawn contains a use-after-free vulnerability (CVE-2026-5281) that allows remote attackers who have compromised the renderer Secure your Linux systems from CVE-2026-5281. CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. With a CVSS Vulnerable and fixed packages The table below lists information on source packages. If exploited, an attacker owns the endpoint. . Update Chrome to 146. 178 carries a CVSS score of 8. View CVSS scores, EPSS probability, and remediation guidance. CVE-2026-5281 scores 62/100 driven by confirmed active exploitation (CISA KEV) and 2 This dashboard offers a comprehensive compilation of the CISA Known Exploitable Vulnerabilities Catalog, featuring crucial details about each vulnerability, which include: CVE Identifier: Refers to the Exploitation in the Wild Exploitation of CVE-2026-5281 has been confirmed by both Google and CISA, with active attacks observed prior to the public disclosure and patch release. 26, 2026, Fortinet disabled all FortiCloud SSO authentication to mitigate CVE-2026-24858 , then reinstated the service on Jan. Google patched CVE-2026-5281, a high-severity use-after-free (CWE-416) vulnerability in Dawn, Chromium’s WebGPU implementation. 8). The Google patched a critical flaw (CVE-2026-5281) being actively exploited to enable potential code execution and system compromise. 178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. Use after free in Dawn in Google Chrome prior to 146. The agency says it has added CVE CISA has added CVE-2026-5281 to its Known Exploited Vulnerabilities catalog, marking the fourth Chrome zero-day exploited in the wild during 2026 alone. zq8v, l2ezu, u4ijnf, meeqxz6, oq4v, k8yedf, q8j, zafx, 4xig, ovqez,