# Chrome zero-day CVE-2026-5281 exploited in wild

Published: 2026-04-02 · Severity: high
Canonical: https://vorant.io/reports/8a3691b5-1cfe-5421-ac94-49f9755d9640/chrome-zero-day-cve-2026-5281-exploited-in-wild

> Google patched 21 Chrome vulnerabilities, including CVE-2026-5281, a use-after-free in Dawn actively exploited in the wild.

Google has released Chrome version 146.0.7680.177/178 addressing 21 vulnerabilities, the most severe of which enable arbitrary code execution. The vulnerabilities span multiple components including CSS, GPU, ANGLE, V8, WebCodecs, WebGL, and PDF rendering. CVE-2026-5281, a use-after-free flaw in the Dawn graphics component, is confirmed to be under active exploitation according to Google.

Successful exploitation allows attackers to execute arbitrary code in the context of the logged-on user through drive-by compromise attacks. Impact severity depends on user privilege levels—administrative accounts face greater risk of program installation, data manipulation, and account creation compared to standard user accounts.

The advisory recommends immediate patching for all Chrome installations across Windows, macOS, and Linux platforms. Organizations should implement automated patch management, employ principle of least privilege, enable anti-exploitation features, and deploy URL filtering alongside user security awareness training focused on recognizing drive-by compromise vectors.

## Mentioned in this report

- Vulnerabilities: CVE-2026-5272, CVE-2026-5273, CVE-2026-5274, CVE-2026-5275, CVE-2026-5276, CVE-2026-5277, CVE-2026-5278, CVE-2026-5279, CVE-2026-5280, CVE-2026-5281 (KEV), CVE-2026-5282, CVE-2026-5283, CVE-2026-5284, CVE-2026-5285, CVE-2026-5286, CVE-2026-5287, CVE-2026-5288, CVE-2026-5289, CVE-2026-5290, CVE-2026-5291, CVE-2026-5292

## Detection guidance (public sample)

### Suspicious Child Process Spawned from Google Chrome (Possible Browser Exploitation)

ATT&CK: T1189

Detects Chrome or its renderer/GPU subprocess spawning a command shell or living-off-the-land binary, consistent with successful exploitation of a browser memory-corruption vulnerability such as CVE-2026-5281 leading to arbitrary code execution in the context of the logged-on user. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned from Google Chrome
id: 2846cf04-646c-5f94-917c-0624ac68f21e
status: experimental
description: 'Detects process creation events where chrome.exe (or one of its subprocesses
  such as the GPU or renderer process)

  is the parent of a command interpreter or commonly abused LOLBin. This behaviour
  is atypical for normal Chrome

  operation and is consistent with successful exploitation of a browser use-after-free
  / memory-corruption

  vulnerability (e.g. CVE-2026-5281 in the Dawn graphics component) that yields arbitrary
  code execution

  in the context of the logged-on user.

  '
references:
- https://chromereleases.googleblog.com/
author: Vorant
tags:
- attack.T1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \chrome.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \wscript.exe
    - \cscript.exe
    - \certutil.exe
    - \bitsadmin.exe
  filter_native_messaging:
    CommandLine|contains:
    - --type=utility
    - --type=gpu-process
    - --utility-sub-type
  condition: selection_parent and selection_child and not filter_native_messaging
falsepositives:
- Chrome native messaging hosts or extension helper applications that legitimately
  launch external executables
- Enterprise software deployment or browser automation frameworks (e.g. Selenium,
  Puppeteer) that spawn helper processes from chrome.exe
- IT-managed print-to-PDF or file-download workflows invoking external converters
level: high
```

### Chrome Renderer/GPU Process Crash Followed by New Process Creation

ATT&CK: T1189

Detects a process creation event whose parent command line indicates a Chrome sandboxed renderer or GPU process (--type=renderer / --type=gpu-process) spawning any non-browser child process, a pattern consistent with sandbox escape after exploitation of a GPU/graphics component vulnerability like CVE-2026-5281. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Chrome Sandboxed Renderer or GPU Process Spawning External Process
id: 6013f968-87ca-5eaf-b238-4e37a2fe0ff1
status: experimental
description: 'Detects a process whose parent command line contains Chrome sandbox
  process-type flags (--type=renderer or

  --type=gpu-process) spawning a child process that is not part of the normal Chrome
  process family. Under normal

  operation, Chrome''s sandboxed renderer and GPU processes do not directly create
  arbitrary external processes;

  observing this is indicative of a sandbox escape following exploitation of a rendering/graphics
  component

  vulnerability such as CVE-2026-5281 (Dawn UAF).

  '
references:
- https://chromereleases.googleblog.com/
author: Vorant
tags:
- attack.T1189
- attack.defense-evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_flags:
    ParentCommandLine|contains:
    - --type=renderer
    - --type=gpu-process
  filter_expected_children:
    Image|endswith:
    - \chrome.exe
    - \crashpad_handler.exe
  condition: selection_parent_flags and not filter_expected_children
falsepositives:
- Chrome crash reporting via crashpad_handler.exe launched from a renderer/GPU process
  context
- Multi-process Chrome architecture spawning additional internal browser helper processes
  during normal operation
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-028

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8a3691b5-1cfe-5421-ac94-49f9755d9640/chrome-zero-day-cve-2026-5281-exploited-in-wild.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup