Google Patches Fourth Chrome Zero-Day of 2026: CVE-2026-5281 in WebGPU Dawn Demands Immediate Update
What Happened
Google released an emergency update for Chrome on April 1, 2026, addressing CVE-2026-5281, a use-after-free vulnerability in Dawn, the cross-platform WebGPU graphics API implementation used across all Chromium-based browsers. Google confirmed an exploit exists in the wild. The patched release is Chrome 146.0.7680.177/178 for Windows and macOS, and 146.0.7680.177 for Linux.
A use-after-free flaw in a graphics rendering component allows an attacker to execute arbitrary code inside the browser process by triggering the corrupted memory state through a specially crafted webpage. The attack path requires no user downloads or plugins. A victim visits a malicious or compromised page and the exploit fires.
CVE-2026-5281 is the fourth actively exploited Chrome zero-day of 2026. The three preceding patches addressed CVE-2026-2441 (iterator invalidation in CSSFontFeatureValuesMap, February), CVE-2026-3909 (out-of-bounds write in Skia graphics library, March), and CVE-2026-3910 (inappropriate implementation in V8 JavaScript engine, March). Four zero-days in under three months represents a significant pace of browser exploitation against a single vendor’s product.
Why This Matters for Canadian Organizations
Chrome holds dominant browser market share in Canadian enterprise environments. Most organizations deploy it as the default browser for productivity suites, SaaS platforms, internal web tools, and employee workstations. An unpatched Chrome installation is an active exploitation target whenever users visit any external website.
Four exploited zero-days in the first quarter of 2026 indicates sustained, well-resourced targeting of Chromium’s rendering and scripting components. The threat actors exploiting browser zero-days include both nation-state groups conducting targeted surveillance and financially motivated actors deploying drive-by infection campaigns at scale. Both threat profiles are relevant to Canadian organizations across government, finance, healthcare, and critical infrastructure sectors.
The challenge for many organizations is update lag. Automatic Chrome updates depend on users restarting their browsers. In enterprise environments with long-running sessions or locked-down update policies, a significant portion of endpoints remain on outdated versions days after a patch is released. The CCCS tracks browser zero-days as requiring priority action, and this vulnerability meets the threshold for emergency deployment.
What to Do
Push Chrome 146.0.7680.177 or later to all managed endpoints through your MDM or endpoint management platform immediately, rather than waiting for automatic update propagation. Verify the update lands on systems where users rarely restart their browsers. Audit other Chromium-based browsers deployed in your environment, including Microsoft Edge, Brave, and Opera, and check for corresponding vendor patches. Enable forced browser restart policies where available to ensure updates apply. Review whether any browser isolation or application sandboxing controls are active and correctly configured on endpoints running web-intensive workloads. If endpoints are used to access sensitive internal systems through a browser, treat the patching window as a period of elevated risk and consider additional monitoring.
Source: BleepingComputer
