Zero-Day Chrome Vulnerability - Immediate Update Required

CSA Alerts & Advisories (Singapore)

Published April 2nd, 2026

Detected April 2nd, 2026

Summary

The Cyber Security Agency of Singapore issued an urgent alert regarding CVE-2026-5281, a use-after-free zero-day vulnerability in Google Chrome's Dawn WebGPU implementation. The vulnerability affects Chrome versions prior to 146.0.7680.177/178 on Windows and Mac, and 146.0.7680.177 on Linux, and is reportedly being actively exploited in the wild.

View original document View source feed page

What changed

Google released security updates addressing a critical use-after-free vulnerability (CVE-2026-5281) in Chrome's Dawn WebGPU implementation. Successful exploitation allows remote attackers with compromised renderer processes to execute arbitrary code via crafted HTML pages. The vulnerability affects all major desktop platforms (Windows, Mac, Linux).\n\nChrome users must immediately update to version 146.0.7680.177/178 (Windows/Mac) or 146.0.7680.177 (Linux). Users should enable automatic updates and monitor for patches for other Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi). While no formal compliance deadline is specified, the active exploitation status demands immediate action.

What to do next

Update Chrome immediately to version 146.0.7680.177/178 or later
Enable automatic updates in Chrome browser settings
Monitor and apply patches for Chromium-based browsers (Edge, Brave, Opera, Vivaldi) when released

Source document (simplified)

Alerts

Active Exploitation of Zero-Day Vulnerability in Google Chrome

2 April 2026

Google has released security updates addressing a zero-day vulnerability in its Chrome browser. Users of Chrome browsers are advised to update to the latest version immediately.

Background

Google has released security updates addressing a zero-day vulnerability (CVE-2026-5281) in its Chrome browser.

Impact

Successful exploitation of the use-after-free vulnerability in Google Chrome’s Dawn WebGPU implementation could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.

Known Exploitation

This vulnerability is reportedly being exploited in the wild.

Affected Products

This vulnerability affects versions of Google Chrome prior to 146.0.7680.177/178 for Windows and MAC, and 146.0.7680.177 for Linux.

Recommendations

Users of Chrome browsers are advised to update their browser to the latest version. Users are also encouraged to enable automatic updates in their Chrome browser to ensure that their software is updated promptly.

Users of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, are also advised to apply the fixes as soon as they become available.

References

https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html

https://nvd.nist.gov/vuln/detail/CVE-2026-5281

https://thehackernews.com/2026/04/new-chrome-zero-day-cve-2026-5281-under.html