CVE-2026-5281: Google Chrome Dawn use-after-free allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityKnown exploitation per CISA KEV and a high CVSS of 8.8, though exploitation requires a pre-compromised renderer, which limits standalone reach.

What it is

Chrome versions before 146.0.7680.178 contain a use-after-free flaw in the Dawn graphics component. An attacker who has already compromised the renderer process can trigger the bug with a crafted HTML page and execute arbitrary code. It matters because Chrome is widely deployed and CISA added this to its Known Exploited Vulnerabilities catalog.

Impact

An attacker gains arbitrary code execution in the browser context, with high impact to confidentiality, integrity and availability. The CVSS vector requires the renderer to already be compromised, so the flaw is a sandbox-escape or post-compromise escalation primitive rather than a standalone entry point.

Attack surface

Reached over the network through a crafted HTML page, requiring user interaction (UI:R) and no privileges (PR:N). The description states the attacker must already have compromised the renderer process, so this is not exploitable from a clean browsing session alone.

Exploitation

Listed in CISA KEV with a due date of 2026-04-15, indicating known exploitation in the wild. EPSS 30-day probability is about 4.9 percent (91.7th percentile), and no ransomware campaign use is documented.

What to do

• Upgrade Chrome to 146.0.7680.178 or later as the primary fix.
• Apply the vendor advisory and CISA BOD 22-01 required actions; discontinue use if mitigations are unavailable.
• Enforce automatic browser updates and verify version compliance across managed endpoints.
• Restrict or isolate high-risk browsing and treat renderer compromise as a serious escalation path.
• Monitor Chromium issue 491518608 and the Chrome release blog for follow-up guidance.

Detection

• Alert on Chrome versions below 146.0.7680.178 in asset inventories and endpoint telemetry.
• Hunt for renderer process crashes or abnormal memory behavior tied to Dawn/graphics activity.
• Look for suspicious child processes or code execution originating from Chrome renderer processes.
• Correlate web proxy or DNS logs for crafted HTML delivery against hosts running vulnerable Chrome builds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.