Chrome zero-day CVE-2026-5281 exploited in wild

Google Chrome has multiple vulnerabilities, including an actively exploited zero-day, that could let attackers execute arbitrary code on victim systems.

CIS/MS-ISAC issued an advisory covering a batch of Chrome vulnerabilities patched in version 146.0.7680.177/178, the most severe allowing arbitrary code execution in the context of the logged-on user. Google has confirmed that an exploit for CVE-2026-5281, a use-after-free vulnerability in the Dawn component, exists in the wild, making it the priority patch item among the disclosed flaws.

The remaining vulnerabilities span use-after-free, heap buffer overflow, integer overflow, and out-of-bounds read issues across Chrome components including CSS, GPU, Codecs, ANGLE, WebUSB, Web MIDI, V8, WebCodecs, WebGL, PDF, WebView, Navigation, and Compositing. Successful exploitation could allow an attacker to install programs, manipulate or delete data, or create new accounts with full privileges, with impact scaled to the privileges of the logged-on user. Exploitation is associated with drive-by compromise as an initial access vector.

Organizations are urged to apply Google's updates immediately, enforce least privilege, restrict web-based content, and enable anti-exploitation features given confirmed in-the-wild exploitation of at least one of the flaws.

title: Chrome Process Spawning High-Privilege Child Process
description: Detects chrome.exe or GoogleUpdate spawning suspicious child processes
  (rundll32, powershell, cmd, regsvcs, msiexec) - typical post-exploitation code execution
  from browser RCE vulnerabilities like CVE-2026-5281. Excludes benign updater activity.
tags:
- attack.execution
- attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \chrome.exe
    - \GoogleUpdate.exe
    Image|endswith:
    - \rundll32.exe
    - \powershell.exe
    - \cmd.exe
    - \regsvcs.exe
    - \msiexec.exe
  filter_update:
    CommandLine|contains:
    - /c del
    - /update
    - /install
    - GoogleUpdate
  condition: selection and not filter_update
falsepositives:
- Chrome extensions legitimately spawning rundll32 for media codecs or plugin initialization
- GoogleUpdate spawning msiexec during background patching
level: high
id: 1318b4c0-7a05-5269-b902-7f5e0a83fe68
status: experimental
author: Vorant

title: Chrome Process Writing Executable to Disk in User Writable Location
description: Detects chrome.exe writing executable files (.exe, .dll, .scr, .bat,
  .cmd, .ps1) to user-writable locations (%TEMP%, %APPDATA%, Downloads) - post-exploitation
  payload staging from browser RCE vulnerabilities.
tags:
- attack.execution
- attack.defense-evasion
- attack.t1189
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \chrome.exe
    TargetFilename|contains:
    - \AppData\Local\Temp\
    - \AppData\Roaming\
    - \Downloads\
    TargetFilename|endswith:
    - .exe
    - .dll
    - .scr
    - .bat
    - .cmd
    - .ps1
  filter_chrome_cache:
    TargetFilename|contains:
    - \AppData\Local\Google\Chrome\User Data\Cache
    - \AppData\Local\Google\Chrome\User Data\Code Cache
  condition: selection and not filter_chrome_cache
falsepositives:
- Chrome installer staging temporary files during auto-update
- Browser extensions legitimately downloading and caching binaries in user temp
level: high
id: 1b96146c-42e4-5c93-97b8-cd3ec8d33267
status: experimental
author: Vorant

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-028