Chrome Dawn Use-After-Free Remote Code Execution Vulnerability

CISA Known Exploited Vulnerabilities (KEV)

Published April 2nd, 2026

Detected April 2nd, 2026

Summary

CISA added CVE-2026-5281 to the Known Exploited Vulnerabilities catalog. This is a use-after-free vulnerability in Google Chrome's Dawn component (versions prior to 146.0.7680.178) that allows remote code execution via a crafted HTML page. The vulnerability has an active exploitation status per SSVC analysis and a CVSS score of 8.8 (High).

View original document View source feed page

What changed

CISA has cataloged CVE-2026-5281, a use-after-free vulnerability in Dawn within Google Chrome. The flaw allows a remote attacker who has compromised the renderer process to execute arbitrary code through a crafted HTML page. Affected versions are prior to 146.0.7680.178. The CVSS 3.1 score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. SSVC analysis confirms active exploitation that is not automatable with total technical impact.

Organizations running Google Chrome should verify their current version and update to 146.0.7680.178 or later immediately. Federal civilian executive branch agencies have 21 days to remediate per BOD 22-01 requirements. All other entities are strongly encouraged to apply the patch as soon as possible given confirmed active exploitation in the wild.

What to do next

Verify Google Chrome version across all endpoints using 146.0.7680.178 or earlier
Update Google Chrome to version 146.0.7680.178 or later to remediate the vulnerability
Review systems for signs of exploitation given active KEV status

Source document (simplified)

Required CVE Record Information

CNA: Chrome

Description

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

Product Status

Learn more Versions 1 Total

Default Status: unknown

affected

affected from 146.0.7680.178 before 146.0.7680.178

References 2 Total

Authorized Data Publishers

Learn more

CISA-ADP

Updated:

2026-04-02

SSVC and KEV, plus CVSS and CWE if not provided by the CNA.

SSVC 1 Total

Learn more
| Exploitation | Automatable | Technical Impact | Version | Date Accessed |
| --- | --- | --- | --- | --- |
| active | no | total | 2.0.3 | 2026-04-01 |

KEV 1 Total

Learn more
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5281 (2026-04-01)

CVSS 1 Total

Learn more
| Score | Severity | Version | Vector String |
| --- | --- | --- | --- |
| 8.8 | HIGH | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |