Chrome zero-day CVE-2026-5281 exploited in wild
Google patched 21 Chrome vulnerabilities, including CVE-2026-5281, a use-after-free in Dawn actively exploited in the wild.
Google has released Chrome version 146.0.7680.177/178 addressing 21 vulnerabilities, the most severe of which enable arbitrary code execution. The vulnerabilities span multiple components including CSS, GPU, ANGLE, V8, WebCodecs, WebGL, and PDF rendering. CVE-2026-5281, a use-after-free flaw in the Dawn graphics component, is confirmed to be under active exploitation according to Google.
Successful exploitation allows attackers to execute arbitrary code in the context of the logged-on user through drive-by compromise attacks. Impact severity depends on user privilege levels—administrative accounts face greater risk of program installation, data manipulation, and account creation compared to standard user accounts.
The advisory recommends immediate patching for all Chrome installations across Windows, macOS, and Linux platforms. Organizations should implement automated patch management, employ principle of least privilege, enable anti-exploitation features, and deploy URL filtering alongside user security awareness training focused on recognizing drive-by compromise vectors.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned from Google Chrome (Possible Browser Exploitation)
Detects Chrome or its renderer/GPU subprocess spawning a command shell or living-off-the-land binary, consistent with successful exploitation of a browser memory-corruption vulnerability such as CVE-2026-5281 leading to arbitrary code execution in the context of the logged-on user. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned from Google Chrome
id: 2846cf04-646c-5f94-917c-0624ac68f21e
status: experimental
description: 'Detects process creation events where chrome.exe (or one of its subprocesses
such as the GPU or renderer process)
is the parent of a command interpreter or commonly abused LOLBin. This behaviour
is atypical for normal Chrome
operation and is consistent with successful exploitation of a browser use-after-free
/ memory-corruption
vulnerability (e.g. CVE-2026-5281 in the Dawn graphics component) that yields arbitrary
code execution
in the context of the logged-on user.
'
references:
- https://chromereleases.googleblog.com/
author: Vorant
tags:
- attack.T1189
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \chrome.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \wscript.exe
- \cscript.exe
- \certutil.exe
- \bitsadmin.exe
filter_native_messaging:
CommandLine|contains:
- --type=utility
- --type=gpu-process
- --utility-sub-type
condition: selection_parent and selection_child and not filter_native_messaging
falsepositives:
- Chrome native messaging hosts or extension helper applications that legitimately
launch external executables
- Enterprise software deployment or browser automation frameworks (e.g. Selenium,
Puppeteer) that spawn helper processes from chrome.exe
- IT-managed print-to-PDF or file-download workflows invoking external converters
level: high
Chrome Renderer/GPU Process Crash Followed by New Process Creation
Detects a process creation event whose parent command line indicates a Chrome sandboxed renderer or GPU process (--type=renderer / --type=gpu-process) spawning any non-browser child process, a pattern consistent with sandbox escape after exploitation of a GPU/graphics component vulnerability like CVE-2026-5281. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Sandboxed Renderer or GPU Process Spawning External Process
id: 6013f968-87ca-5eaf-b238-4e37a2fe0ff1
status: experimental
description: 'Detects a process whose parent command line contains Chrome sandbox
process-type flags (--type=renderer or
--type=gpu-process) spawning a child process that is not part of the normal Chrome
process family. Under normal
operation, Chrome''s sandboxed renderer and GPU processes do not directly create
arbitrary external processes;
observing this is indicative of a sandbox escape following exploitation of a rendering/graphics
component
vulnerability such as CVE-2026-5281 (Dawn UAF).
'
references:
- https://chromereleases.googleblog.com/
author: Vorant
tags:
- attack.T1189
- attack.defense-evasion
logsource:
category: process_creation
product: windows
detection:
selection_parent_flags:
ParentCommandLine|contains:
- --type=renderer
- --type=gpu-process
filter_expected_children:
Image|endswith:
- \chrome.exe
- \crashpad_handler.exe
condition: selection_parent_flags and not filter_expected_children
falsepositives:
- Chrome crash reporting via crashpad_handler.exe launched from a renderer/GPU process
context
- Multi-process Chrome architecture spawning additional internal browser helper processes
during normal operation
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-028
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free