{"id":"chrome-dawn-exploited-flaw-mar-2026","category":"patch","status":"closed","title":"Chrome, Edge and Opera fix exploited Dawn memory flaw CVE-2026-5281","tldr":"Attackers exploited a memory flaw in Dawn, a graphics component used by Chromium browsers. Chrome, Edge and Opera have released fixes. Update your browser to its latest version and restart it to complete installation.","summary":"CVE-2026-5281 is a high-severity memory flaw in Dawn, the graphics component that implements WebGPU in Chromium browsers. It lets an attacker who has already compromised the browser’s page-rendering process use a malicious web page to run their code. Google disclosed the flaw and released desktop Chrome fixes on 31 March, confirming that an exploit existed in the wild. CISA listed it as exploited on 1 April. Microsoft released an Edge fix that day, and Opera confirmed fixes for its listed desktop browsers and Android browser on 4 April. As at 3 November, fixes are available for these products; Google’s announcement did not identify the attackers, victims or scale of the attacks. The sources reviewed did not establish when exploitation began or whether it has stopped.","action":"Update Chrome, Edge or Opera to its latest available version, then close and reopen the browser to finish installing it. Check the browser’s About or Update page, and ask your IT team if updates on a work computer are managed.","product":"Google Chrome, Microsoft Edge and Opera browsers using Dawn","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-5281"],"tags":["google","chrome","edge","opera","browser","zero-day","use-after-free"],"affected":["Google Chrome desktop before the 31 March 2026 security update: 146.0.7680.177/178 for Windows and macOS; 146.0.7680.177 for Linux","Microsoft Edge Stable before 146.0.3856.97","Opera One before 129.0.5823.65","Opera GX before 129.0.5823.64","Opera Air before 129.0.5823.63","Opera Neon before 129.0.5823.68","Opera for Android before 97"],"fixed":["Google Chrome 146.0.7680.177/178 for Windows and macOS","Google Chrome 146.0.7680.177 for Linux","Microsoft Edge Stable 146.0.3856.97","Opera One 129.0.5823.65","Opera GX 129.0.5823.64","Opera Air 129.0.5823.63","Opera Neon 129.0.5823.68","Opera for Android 97"],"matches":[{"platform":"windows","app":"Google Chrome","bundle":"","fixed":"146.0.7680.178"},{"platform":"macos","app":"Google Chrome","bundle":"com.google.Chrome","fixed":"146.0.7680.178"},{"platform":"linux","app":"Google Chrome","bundle":"","fixed":"146.0.7680.177"},{"platform":"windows","app":"Microsoft Edge","bundle":"","fixed":"146.0.3856.97"},{"platform":"macos","app":"Microsoft Edge","bundle":"com.microsoft.edgemac","fixed":"146.0.3856.97"},{"platform":"linux","app":"Microsoft Edge","bundle":"","fixed":"146.0.3856.97"},{"platform":"other","app":"Opera One","bundle":"","fixed":"129.0.5823.65"},{"platform":"other","app":"Opera GX","bundle":"","fixed":"129.0.5823.64"},{"platform":"other","app":"Opera Air","bundle":"","fixed":"129.0.5823.63"},{"platform":"other","app":"Opera Neon","bundle":"","fixed":"129.0.5823.68"},{"platform":"android","app":"Opera","bundle":"","fixed":"97"}],"sources":[{"kind":"advisory","title":"Stable Channel Update for Desktop","url":"https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html","by":"Google","date":"2026-03-31"},{"kind":"advisory","title":"Release notes for Microsoft Edge Security Updates — April 1, 2026","url":"https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security","by":"Microsoft","date":"2026-04-01"},{"kind":"advisory","title":"Update your browser: Security fix for Chrome zero-day CVE-2026-5281","url":"https://blogs.opera.com/security/2026/04/update-your-browser-security-fix-for-chrome-zero-day-cve-2026-5281/","by":"Opera","date":"2026-04-04"},{"kind":"advisory","title":"Google Chrome security advisory (AV26-306) – Update 1","url":"https://www.cyber.gc.ca/en/alerts-advisories/google-chrome-security-advisory-av26-306","by":"Canadian Centre for Cyber Security","date":"2026-04-01"},{"kind":"advisory","title":"CVE-2026-5281 — use after free in Dawn","url":"https://github.com/advisories/GHSA-xf76-839h-pfpm","by":"GitHub Advisory Database","date":"2026-04-01"},{"kind":"news","title":"Google fixes fourth Chrome zero-day exploited in attacks in 2026","url":"https://www.bleepingcomputer.com/news/security/google-fixes-fourth-chrome-zero-day-exploited-in-attacks-in-2026/","by":"BleepingComputer","date":"2026-04-01"},{"kind":"news","title":"Exploited Zero-Day Among 21 Vulnerabilities Patched in Chrome","url":"https://www.securityweek.com/exploited-zero-day-among-21-vulnerabilities-patched-in-chrome/","by":"SecurityWeek","date":"2026-04-01"}],"started":"2026-04-01","closed":"2026-04-04","created":"2026-11-03T22:27:47.843Z","updated":"2026-11-03T22:27:47.843Z","cve_notes":[{"cve":"CVE-2026-5281","name":"Use-after-free in Chromium’s Dawn graphics component","what":"Dawn can reuse memory after it has been freed, allowing an attacker who has already compromised the browser’s page-rendering process to run their code through a malicious web page.","severity":"high","cvss":8.8}],"timeline":[{"at":"2026-04-04","added":"2026-11-03T22:23:31.291Z","kind":"new-fix","text":"Opera confirmed fixes in Opera One 129.0.5823.65, GX 129.0.5823.64, Air 129.0.5823.63, Neon 129.0.5823.68 and Opera for Android 97.","url":"https://blogs.opera.com/security/2026/04/update-your-browser-security-fix-for-chrome-zero-day-cve-2026-5281/","by":"Opera","patch":"patched"},{"at":"2026-04-01","added":"2026-11-03T22:23:31.291Z","kind":"new-fix","text":"Microsoft released Edge Stable 146.0.3856.97 and explicitly confirmed that it fixed CVE-2026-5281.","url":"https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security","by":"Microsoft","patch":"partial"},{"at":"2026-04-01","added":"2026-11-03T22:23:31.291Z","kind":"cisa-added","text":"CISA added CVE-2026-5281 to its Known Exploited Vulnerabilities catalogue, according to the Canadian Centre for Cyber Security.","url":"https://www.cyber.gc.ca/en/alerts-advisories/google-chrome-security-advisory-av26-306","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-03-31","added":"2026-11-03T22:23:31.291Z","kind":"disclosed","text":"Google disclosed CVE-2026-5281 and confirmed an exploit existed in the wild. It released Chrome 146.0.7680.177/178 for Windows and macOS and 146.0.7680.177 for Linux, with rollout over the following days and weeks.","url":"https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html","by":"Google","patch":"partial"}],"url":"https://hard.fyi/live/chrome-dawn-exploited-flaw-mar-2026/","json":"https://hard.fyi/api/live?id=chrome-dawn-exploited-flaw-mar-2026"}