CVE-2026-5281: Google Dawn Use-After-Free Vulnerability
Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Overview
A use-after-free flaw in Dawn, Chrome's WebGPU implementation, affects Google Chrome versions prior to 146.0.7680.178 and can be triggered by a crafted HTML page. Because Dawn handles GPU resource management, a dangling pointer in its memory handling can be reached from within the renderer process. Google has confirmed active exploitation in the wild. Other Chromium-based browsers, including Microsoft Edge and Opera, may also be affected.
Vulnerability details
Use-after-free vulnerabilities (CWE-416) occur when a program continues to reference a memory object after it has been freed. In Chrome's architecture, Dawn manages WebGPU objects and their lifetimes across the renderer and GPU process boundary. When a Dawn object is freed but a reference to it persists, subsequent access to that dangling pointer can corrupt adjacent memory or redirect execution flow. Because the GPU subsystem operates with elevated trust relative to the renderer, a UAF in Dawn is a meaningful target for sandbox escape chains.
This flaw is part of a chained exploit: an attacker must first compromise the Chrome renderer process through a separate vulnerability, then deliver a crafted HTML page that exercises the Dawn WebGPU component in a way that triggers the freed-memory dereference. From that position, the attacker gains arbitrary code execution outside the renderer sandbox, in a more privileged browser process context, which can lead to full system compromise. User interaction is required because the victim must visit or be directed to the attacker-controlled page. Google has confirmed an exploit exists in the wild.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review endpoint detection or EDR telemetry for Chrome browser processes spawning unexpected child processes or making unusual inter-process calls immediately after GPU process termination, where no corresponding driver error or resource-exhaustion event is logged.
- Audit browser crash reports for GPU process failures that occur in close temporal proximity to WebGPU API activity, particularly on hosts where no graphics driver update or hardware change preceded the crash.
Remediation
Additional hardening
- Update Google Chrome to 146.0.7680.178 on Windows and Mac, or 146.0.7680.177 on Linux; apply equivalent updates to other Chromium-based browsers such as Microsoft Edge and Opera as vendor patches become available.
- Restrict browsing to known, trusted sites via DNS filtering or web proxy policy to reduce the likelihood of users reaching attacker-controlled pages that could deliver the exploit chain.
- Consider deploying Chrome in a hardened profile with GPU acceleration disabled or restricted where WebGPU is not operationally required, reducing the Dawn attack surface until patching is complete.
- Prioritize patching for users with access to sensitive systems or elevated network privileges, as a successful sandbox escape from this chain can lead to broader host compromise.
Key dates
References
Frequently asked questions
Does CVE-2026-5281 affect my FedRAMP authorization?
If Google Dawn runs inside your authorization boundary, CVE-2026-5281 affects your FedRAMP authorization directly. CISA listed this vulnerability in its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of April 15, 2026, a date that has already passed. An unpatched KEV inside your boundary is an assessor finding. An overdue one is visible to both your assessor and your sponsoring agency. Your position now is to remediate and formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-5281?
Knox does not patch your software. Under the FedRAMP shared-responsibility model, remediating Google Dawn is your obligation. What Knox provides is the pre-authorized, single-tenant boundary in which that remediation work takes place, along with Knox's automated continuous monitoring platform and audit-artifact coverage that support documentation for your next assessment. The fix belongs to your team. Maintaining your compliance posture while you apply it is not something you manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment continuously for newly disclosed vulnerabilities and compliance issues, including cases like CVE-2026-5281. Exposure surfaces during ongoing monitoring rather than waiting until an assessor flags it at a scheduled review, giving your team earlier visibility and more time to act.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-5281's remediation deadline of April 15, 2026 has passed. What happens now?
If CVE-2026-5281 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship on solid ground.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
