Chrome, Edge and Opera fix exploited Dawn memory flaw CVE-2026-5281
Attackers exploited a memory flaw in Dawn, a graphics component used by Chromium browsers. Chrome, Edge and Opera have released fixes. Update your browser to its latest version and restart it to complete installation.
Update Chrome, Edge or Opera to its latest available version, then close and reopen the browser to finish installing it. Check the browser’s About or Update page, and ask your IT team if updates on a work computer are managed.
- Google Chromefixed in 146.0.7680.178 and later
- Google Chromefixed in 146.0.7680.178 and later
- Google Chromefixed in 146.0.7680.177 and later
- Microsoft Edgefixed in 146.0.3856.97 and later
- Microsoft Edgefixed in 146.0.3856.97 and later
- Microsoft Edgefixed in 146.0.3856.97 and later
- Opera Onefixed in 129.0.5823.65 and later
- Opera GXfixed in 129.0.5823.64 and later
- Opera Airfixed in 129.0.5823.63 and later
- Opera Neonfixed in 129.0.5823.68 and later
- Operafixed in 97 and later
What’s happening
CVE-2026-5281 is a high-severity memory flaw in Dawn, the graphics component that implements WebGPU in Chromium browsers. It lets an attacker who has already compromised the browser’s page-rendering process use a malicious web page to run their code. Google disclosed the flaw and released desktop Chrome fixes on 31 March, confirming that an exploit existed in the wild. CISA listed it as exploited on 1 April. Microsoft released an Edge fix that day, and Opera confirmed fixes for its listed desktop browsers and Android browser on 4 April. As at 3 November, fixes are available for these products; Google’s announcement did not identify the attackers, victims or scale of the attacks. The sources reviewed did not establish when exploitation began or whether it has stopped.
- What
- Flaw
- Affects
- Google Chrome, Microsoft Edge and Opera browsers using Dawn
- Affected
- Google Chrome desktop before the 31 March 2026 security update: 146.0.7680.177/178 for Windows and macOS; 146.0.7680.177 for Linux
Microsoft Edge Stable before 146.0.3856.97
Opera One before 129.0.5823.65
Opera GX before 129.0.5823.64
Opera Air before 129.0.5823.63
Opera Neon before 129.0.5823.68
Opera for Android before 97 - Fixed in
- Google Chrome 146.0.7680.177/178 for Windows and macOS
Google Chrome 146.0.7680.177 for Linux
Microsoft Edge Stable 146.0.3856.97
Opera One 129.0.5823.65
Opera GX 129.0.5823.64
Opera Air 129.0.5823.63
Opera Neon 129.0.5823.68
Opera for Android 97 - Since
- 1 Apr 2026
- Closed
- 4 Apr 2026
Timeline
- New fixFixed
Opera confirmed fixes in Opera One 129.0.5823.65, GX 129.0.5823.64, Air 129.0.5823.63, Neon 129.0.5823.68 and Opera for Android 97.
- New fixPartly fixed
Microsoft released Edge Stable 146.0.3856.97 and explicitly confirmed that it fixed CVE-2026-5281.
- CISA added
CISA added CVE-2026-5281 to its Known Exploited Vulnerabilities catalogue, according to the Canadian Centre for Cyber Security.
- Made publicPartly fixed
Google disclosed CVE-2026-5281 and confirmed an exploit existed in the wild. It released Chrome 146.0.7680.177/178 for Windows and macOS and 146.0.7680.177 for Linux, with rollout over the following days and weeks.
Sources
- Stable Channel Update for DesktopGoogle · 31 Mar 2026
- Release notes for Microsoft Edge Security Updates — April 1, 2026Microsoft · 1 Apr 2026
- Update your browser: Security fix for Chrome zero-day CVE-2026-5281Opera · 4 Apr 2026
- Google Chrome security advisory (AV26-306) – Update 1Canadian Centre for Cyber Security · 1 Apr 2026
- CVE-2026-5281 — use after free in DawnGitHub Advisory Database · 1 Apr 2026
- Google fixes fourth Chrome zero-day exploited in attacks in 2026BleepingComputer · 1 Apr 2026
- Exploited Zero-Day Among 21 Vulnerabilities Patched in ChromeSecurityWeek · 1 Apr 2026