CVE-2026-5281

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-5281 8.8

Google · Dawn · Added 2026-04-01 · Published 2026-04-01

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityGoogle Dawn Use-After-Free Vulnerability

VendorGoogle

ProductDawn

Date added2026-04-01

Due date2026-04-15

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-416

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Descriptions

KEV: Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

NVD: Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-28 01:45 UTC

Wall time120s

Searches4

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2026-5281
https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html
https://github.com/TheMalwareGuardian/CVE-2026-5281
https://github.com/umair-aziz025/CVE-2026-5281-Research-Toolkit
https://socradar.io/blog/cve-2026-5281-chrome-webgpu-zero-day/
https://www.helpnetsecurity.com/2026/04/01/google-chrome-zero-day-cve-2026-5281/
https://www.sentinelone.com/vulnerability-database/cve-2026-5281/

QC notes

warn component_extraction: Component 'Dawn WebGPU GPUBuffer lifetime tracking in the queue.submit()/buffer.destroy() asynchronous race path where VRAM is freed while GPU commands still reference the buffer handle' matches or contains product name 'Dawn' — no specific component identified

Hunting hypothesis agent

Hunt for DXGI_ERROR_DEVICE_REMOVED or DEVICE_HUNG in Windows DXGI logs when Chrome GPU process reports device lost due to internal error, since Dawn queue.submit/buffer.destroy race frees VRAM still referenced by in-flight shader commands.

Research details

ComponentDawn WebGPU GPUBuffer lifetime tracking in the queue.submit()/buffer.destroy() asynchronous race path where VRAM is freed while GPU commands still reference the buffer handle

PreconditionsAttacker must first achieve compromise of the Chrome renderer process via a separate vulnerability; target must run Chrome prior to version 146.0.7680.178 (or other Chromium-based browser with an unpatched bundled Dawn); user must visit a crafted HTML page that triggers malicious WebGPU API calls calling queue.submit() followed by buffer.destroy() on the same GPUBuffer to exploit the race condition; WebGPU must be enabled (default in Chrome 146+) agent

DeliveryA crafted HTML page served over HTTPS triggers WebGPU JavaScript that allocates 200 temporary GPUStorageBuffers with randomized sizes, submits 32 parallel compute pipelines (1000-iteration inner loops, 4096 workgroup dispatches) to saturate the GPU queue, then calls buffer.destroy() on all 200 buffers immediately after queue.submit() to free VRAM while GPU commands still reference the hardware handles. 32 new same-size buffer allocations reuse the freed VRAM addresses, causing in-flight shader commands to read from or write to memory belonging to the live replacement allocations, triggering a DXGI_ERROR_DEVICE_REMOVED/DEVICE_HUNG fault. Delivered as encrypted HTTPS web traffic; attacker must first compromise the renderer process to deliver the Dawn-triggering WebGPU calls.

Public PoCyes

PoC URLs https://github.com/TheMalwareGuardian/CVE-2026-5281
https://github.com/umair-aziz025/CVE-2026-5281-Research-Toolkit Third-party repos; verify before use.

Advisoryhttps://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html

Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 7.0–8.9) | Exploitation requires renderer compromise first (chain vulnerability); the UAF itself involves a complex race condition between GPU command submission and buffer destruction, requiring precise timing with GPU queue saturation to win the race; demonstrated in lab with 200 temporary storage buffers, 32 parallel compute pipelines, and aggressive destroy-then-reallocate sequence

SummaryCVE-2026-5281 is a use-after-free vulnerability in Dawn, Chrome's WebGPU implementation (fixed in Chrome 146.0.7680.178), where GPU buffer objects can be freed while still referenced by in-flight GPU commands due to a race condition between queue.submit() and buffer.destroy() JavaScript API calls. Exploited in the wild as a sandbox escape in a chain attack where the renderer is first compromised via another vulnerability, allowing arbitrary code execution through crafted HTML pages with malicious WebGPU API calls that trigger dangling GPU buffer references read by in-flight shader execution at the hardware level.

Tia coverage

First reported2026-06-09

First exploit report2026-06-09

Exploit report → KEV69 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

google-fixes-actively-exploited-android-zero-day-on-pixel-device google-patches-5th-chrome-zero-day-of-2026-cve-2026-11645-v8-eng

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.