Report · SecurityWeekAbout CVE-2026-5281Published 1 Apr 2026

Exploited Zero-Day Among 21 Vulnerabilities Patched in Chrome

Source SecurityWeek

Compare

Authoritative record:CVE-2026-5281· High 8.8

Exploited in the wild · KEV due 15 Apr 2026 : upgrade to 146.0.7680.178 now.

Data as of 29 Oct 2026, 19:04 UTC

CVSS 3.1 base score

8.8High

How severe the flaw is on the 0–10 CVSS scale.

KEV deadline: 15 Apr 2026 US federal agencies must patch by this date; a sensible deadline for everyone else. Other KEV due dates
Patch: Available – fixed in 146.0.7680.178

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 1 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: evidence found.
Listed in CISA KEV the same day as disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE ID reserved
by Chrome
31 Mar 202620:07 UTC, 9 hours before disclosure
CVE published
on cve.org
1 Apr 202604:41 UTC, t = 0
In Threat Radar
record ingested
1 Apr 202604:53 UTC, 12 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed
1 Apr 2026, the same day as disclosure
KEV remediation due
US federal deadline
15 Apr 2026, 14 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Chrome to 146.0.7680.178.

Affected software

Product	Affected	Fixed in
GoogleChrome	Affected >=146.0.7680.178 <146.0.7680.178	Fixed in 146.0.7680.178

AI-suggested

Organizations and users should immediately update Chrome to the latest patched version to remediate CVE-2026-5281 and the other vulnerabilities. Beyond patching, deploying endpoint detection and response (EDR) solutions that monitor browser behavior can help detect exploitation attempts. Network-level protections such as web filtering and blocking access to known malicious domains can reduce exposure. Educating users to avoid suspicious links or downloads reduces the risk of triggering exploitation. For high-security environments, consider implementing browser isolation or sandboxing technologies to limit the impact of potential browser exploits. Regularly review and audit browser extensions and plugins to minimize attack surface. Monitoring threat intelligence feeds for indicators of compromise related to this zero-day can aid in early detection of active exploitation campaigns. Finally, ensure incident response plans include scenarios involving browser-based zero-day exploits.

Description

Google has patched a zero-day vulnerability identified as CVE-2026-5281 affecting the Dawn component of Chrome, alongside 20 other vulnerabilities. This zero-day was actively exploited prior to the patch release, indicating a real-world threat. The vulnerability impacts Chrome users globally, potentially allowing attackers to execute arbitrary code or compromise browser security. Although the severity is rated medium, the presence of an active exploit elevates the urgency for patching. No detailed technical specifics or affected Chrome versions were disclosed publicly. Organizations relying on Chrome should prioritize updating to the latest version to mitigate risk. The threat primarily targets Chrome users, which are widespread worldwide, with higher risk in countries with large Chrome user bases. Given the lack of detailed exploit complexity and authentication requirements, the threat is assessed as medium severity. Defenders must ensure rapid deployment of updates and monitor for suspicious browser activity related to exploitation attempts.

Impact

The exploitation of CVE-2026-5281 can lead to unauthorized code execution within the Chrome browser context, potentially allowing attackers to steal sensitive information, install malware, or pivot to other system components. For organizations, this could result in data breaches, loss of intellectual property, or disruption of business operations. Since Chrome is widely used across enterprises, governments, and individuals, the threat has a broad attack surface. The active exploitation prior to patching increases the risk of targeted attacks, especially against high-value targets using Chrome. The medium severity indicates that while the vulnerability is serious, it may not be trivially exploitable or may require user interaction, somewhat limiting mass exploitation. However, failure to patch promptly could lead to increased incidents of browser compromise, phishing, or drive-by downloads. The threat also highlights the importance of browser security hygiene as a frontline defense in organizational cybersecurity.

Summary

The reported security threat involves a zero-day vulnerability, CVE-2026-5281, in Google's Chrome browser, specifically within the Dawn component. This vulnerability was one of 21 patched in a recent update, with Google confirming that it was actively exploited in the wild prior to the release of the fix. The Dawn component is part of Chrome's rendering or internal processing architecture, though exact technical details of the flaw have not been publicly disclosed. The zero-day likely allows attackers to execute arbitrary code or bypass security controls within the browser, potentially leading to compromise of user data or system integrity. The absence of detailed technical information limits precise understanding of the attack vector, but the active exploitation indicates that attackers have weaponized the vulnerability. No specific affected Chrome versions were listed, but given the nature of Chrome's rapid update cycle, the vulnerability probably affects recent stable releases. The medium severity rating suggests that exploitation may require some user interaction or conditions, and the impact, while significant, may not lead to full system compromise in all cases. The patch release alongside 20 other vulnerabilities underscores the importance of timely updates to maintain browser security.

References

securityweek.com/exploited-zero-day-among-21-vulnerabilities-patched-in-chrome/ (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Affected software

Description

AI analysisMachine-generated, updated 1 Apr 2026, 14:38 UTC

Public exploits and detectionGitHub proofs of concept

References

Community reviews