Chrome WebGPU flaw fixed since version 146: where 2026's exploited zero-days stand

Dawn, the WebGPU implementation that powers graphics rendering in Google Chrome, contains a use-after-free vulnerability (a flaw where the program keeps using memory it has already released), tracked as CVE-2026-5281, in all versions prior to 146.0.7680.178. Exploitation in real-world attacks has been confirmed. The fix shipped in Chrome 146.0.7680.177/.178, released on March 31, 2026. The current stable channel has since moved on to the 150 series, so if your browser updates (and restarts) normally, no action is needed. Only devices still stuck below 146.0.7680.177 need an immediate update.

This was the fourth Chrome zero-day confirmed to be exploited in 2026. The day after the patch, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to the KEV catalog (its list of vulnerabilities under active attack) and ordered federal agencies to patch by April 15, 2026 — a deadline that passed more than three months ago. In June, a fifth exploited zero-day, CVE-2026-11645 (an out-of-bounds read/write in V8), was patched, bringing 2026's total to five as of July 23, 2026. Each one has hit a different component: CSS processing, 2D rendering, the JavaScript engine, and the GPU rendering layer.

The Market Behind Chrome Zero-Days

Five exploited Chrome zero-days in the first half of 2026 is not random luck; it is the visible surface of a market where each Chrome exploit chain trades for millions of dollars to a very specific buyer set.

The people who actually hold a working Chrome zero-day are not lone-wolf hobbyists; they sit in a budget bracket several orders of magnitude above that. State-sponsored cyber espionage units, intelligence officers of authoritarian regimes tracking journalists and dissidents, industrial spies after pre-earnings drafts and M&A; documents, and initial-access brokers who resell footholds into already-compromised companies to ransomware crews form the core buyer set. What they want from a hole in Chrome is the unsent confidential message in Gmail and the shared drives behind Google Workspace, the corporate credentials piled up in the browser's password manager, the live SaaS admin sessions cached in cookies, the federated access through Google Sign-In into a target's Slack/Notion/GitHub, and the customer lists and financial models synced to the work laptop. The single second a crafted page renders, the chain renderer → Dawn use-after-free → sandbox escape → OS execution opens end-to-end through this one CVE.

In security terminology, a browser zero-day is the opening "initial access vector" of a longer attack chain. The reason a relatively new, lightly audited codebase like WebGPU/Dawn keeps being targeted is precisely that attackers deliberately pick territories where defensive review has not yet caught up. A chain that begins in a compromised renderer, pivots through a freed Dawn object, and ends in a sandbox escape is the kind of exploit traded between commercial offensive vendors at the multi-million-dollar mark, with buyers that are basically governments or contractors acting on their behalf (NSO Group, Intellexa, and the like). CISA giving federal agencies a two-week deadline after KEV listing was a quiet acknowledgement that the assumed adversary here is nation-state class.

CVSS 8.8 is only a technical reading. What Chrome users inside enterprises and government actually lose is not a crashed browser; it is that the active login sessions to work accounts, the foothold into internal systems, and the entryway into the customer database silently change hands to a nation-state-scale espionage operation.

CVE-2026-5281 at a Glance

According to the National Vulnerability Database (NVD), CVE-2026-5281 is described as "use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page."

At the time of disclosure, Google acknowledged that "an exploit for CVE-2026-5281 exists in the wild," adding that technical details would remain restricted "until a majority of users are updated with a fix." That stable channel update patched a total of 21 vulnerabilities, 19 rated HIGH and 2 rated MEDIUM. As of July 23, 2026, Google has not published who used this hole or against whom — no attribution or campaign details have been released, and the technical details remain restricted.

It Wasn't Just Chrome That Was Affected

Because CVE-2026-5281 resides in a Chromium component, it affected all Chromium-based browsers, not just Chrome. This includes Microsoft Edge, Brave, Opera, Vivaldi, and others, which collectively account for roughly 65% of the desktop browser market worldwide.

In the days right after disclosure, the status of Edge, Brave, and Opera could not be confirmed. Today, every major Chromium-based browser has long since moved to builds based on Chromium 150, well past the fixed 146 release, so an up-to-date browser is no longer exposed (we have not found the individual vendors' security advisories naming CVE-2026-5281, but the underlying Chromium version contains the fix). "I use Edge, not Chrome, so this doesn't concern me" is the wrong takeaway — Edge uses Chromium's Dawn under the hood. If a machine has gone unpatched for a long time, check its version page.

How to Check Your Chrome Version

Chrome updates are delivered automatically, but they require a browser restart to take effect. If you tend to keep your browser open for days or weeks at a time, or updates are held back on a managed work device, there's a chance you're still running an unpatched version. Here's how to check manually.

1. Type chrome://settings/help into the address bar and press Enter.

2. The "About Google Chrome" page will appear and automatically check for updates.

3. If the version number shows 146.0.7680.177 or higher, you're protected against this vulnerability. As of July 23, 2026, the stable channel is on the 150 series (e.g. 150.0.7871.181/.182), so a browser that updates normally is well past this threshold. If a "Relaunch" button is shown, click it to apply the latest version.

CISA's April 15, 2026 deadline for federal agencies passed more than three months ago. While that mandate never legally bound private organizations, it remains a widely referenced benchmark for how urgently an exploited vulnerability should be patched. If any device is still below 146.0.7680.177 nearly four months after disclosure, it has been running with a hole that attackers demonstrably know how to use — update it without delay.

Chrome's Exploited Zero-Days of 2026 So Far

By July 23, 2026, five Chrome zero-day vulnerabilities had been exploited in real-world attacks this year. CVE-2026-5281 was the fourth; about two months later, the fifth, CVE-2026-11645, was patched in June. With 2025 having seen eight for the entire year, five in six months puts 2026 ahead of last year's pace.

← Swipe to navigate

What all five have in common is a CVSS score around 8.8 (HIGH) and the fact that the attack surface shifts to a different component each time: CSS processing, 2D rendering, the JavaScript engine, and the GPU rendering engine. Attackers are probing a wide range of Chromium's codebase.

Why WebGPU Is Becoming an Attack Surface

To understand this vulnerability, you need to know how Dawn and WebGPU relate to each other.

WebGPU is a new API standard that gives web browsers direct access to a device's graphics processing unit (GPU). It enables lower-level GPU control than the legacy WebGL (2011), making it possible to run 3D graphics and machine learning inference at high speed within the browser. Dawn is the open-source library that implements this WebGPU standard for Chromium.

The challenge is that GPU resource management is inherently complex. According to CVEReports' analysis, the root cause of CVE-2026-5281 is a race condition in Dawn's command buffer queue management. When command buffers are submitted from JavaScript to the GPU and subsequently destroyed, the system fails to maintain proper synchronization between the buffer object lifecycle and the GPU task queue processing state. This leaves dangling pointers to freed memory, which attackers can overwrite with arbitrary data.

The attack unfolds in two stages. First, a separate vulnerability is used to compromise the browser's renderer process (the process responsible for drawing web pages). Then, this Dawn bug is exploited to escape the browser sandbox and achieve arbitrary code execution at the host OS level.

Notably, the same update fixed three Dawn-related vulnerabilities simultaneously: CVE-2026-5281, CVE-2026-4676 (another Dawn use-after-free), and CVE-2026-5284 (yet another Dawn use-after-free). All were reported by the same anonymous researcher 86ac1f1587b71893ed2ad792cd7dde32, who according to Help Net Security also reported a WebGL heap buffer overflow (CVE-2026-4675). The concentration of bugs in graphics-related components is striking.

The Structural Reasons Behind Chrome's Zero-Day Surge

Of 2026's five exploited zero-days, four are memory-handling bugs — iterator invalidation, an out-of-bounds write, a use-after-free, and an out-of-bounds read/write. The only exception is CVE-2026-3910, classified as an inappropriate implementation in V8. This is no coincidence.

Chromium is primarily written in C++, where memory management is the programmer's responsibility. Google has previously published an analysis stating that roughly 70% of Chromium's security bugs stem from memory safety issues. Use-after-free is the quintessential example.

Google is tackling this problem with two approaches. The first is MiraclePtr, a smart pointer mechanism for C++ that detects use-after-free conditions and crashes the process before exploitation can succeed. The second is the gradual introduction of Rust into the Chromium codebase, which provides compile-time memory safety guarantees.

However, GPU-related components like Dawn are still relatively new, and their code maturity lags behind V8 and Blink. The WebGPU specification itself only shipped as stable in 2023. For attackers, this represents a "new attack surface likely rich in undiscovered bugs."

PCQuest characterizes this situation as "revealing a bigger browser security problem." The diversification of attack surfaces means that hardening one component simply redirects attackers to another, a whack-a-mole dynamic. Indeed, two months after CVE-2026-5281, the fifth exploited zero-day (CVE-2026-11645) landed in V8. The only fundamental solutions are to accelerate the migration from C++ to memory-safe languages, or to layer sandboxes more deeply to contain the blast radius of any single zero-day.

Key Takeaways

CVE-2026-5281 is a use-after-free in Dawn, the WebGPU implementation, allowing arbitrary code execution once an attacker had compromised the renderer process. It was exploited in real-world attacks, and every Chromium-based browser — Chrome, Edge, Brave, Vivaldi, Opera — was affected. It has been fixed since Chrome 146.0.7680.177/.178, released March 31, 2026.

As of July 23, 2026, the stable channel is on the 150 series. If your browser auto-updates and gets restarted normally, no further action is needed for this vulnerability. For machines that have gone a long time without a restart, or managed work devices with updates held back, open chrome://settings/help (or your browser's equivalent page) and confirm the version is 146.0.7680.177 or higher — ideally the latest 150 series.

The five exploited zero-days of 2026 show attack surfaces expanding from CSS to Skia, V8, and WebGPU. More of the same should be expected, which makes one habit worth keeping: treat browser updates not as "when I get around to it" but as "check the moment a security advisory appears."

Sources

• ▸ Google Chrome Releases - Stable Channel Update for Desktop (March 31, 2026)
• ▸ NVD - CVE-2026-5281 Detail (April 1, 2026)
• ▸ CISA - Known Exploited Vulnerabilities Catalog (Added April 1, 2026)
• ▸ BleepingComputer - Google fixes fourth Chrome zero-day exploited in attacks in 2026 (April 1, 2026)
• ▸ Help Net Security - Google fixes Chrome zero-day with in-the-wild exploit (CVE-2026-5281) (April 1, 2026)
• ▸ SecurityAffairs - Google fixes fourth actively exploited Chrome zero-day of 2026 (April 1, 2026)
• ▸ BleepingComputer - Google patches fifth Chrome zero-day bug exploited in attacks this year (CVE-2026-11645) (June 2026)
• ▸ Google Chrome Releases - Stable Channel Update for Desktop (CVE-2026-11645 fix) (June 2026)
• ▸ UpdateStar News - Chrome 150.0.7871.181/182 patches 12 high-severity security flaws (July 2026)
• ▸ CVEReports - CVE-2026-5281: High-Severity Use-After-Free in Dawn WebGPU Implementation
• ▸ PCQuest - Chrome's fourth zero-day of 2026 reveals a bigger browser security problem
• ▸ Chromium - Memory Safety