Exploited Zero-Day Among 21 Vulnerabilities Patched in Chrome

Summary

Google released Chrome 146 addressing 21 vulnerabilities, including CVE-2026-5281, a use-after-free zero-day in the Dawn graphics component that has been actively exploited in the wild. The patch also fixed CVE-2026-5284, another high-severity use-after-free in Dawn reported by the same researcher but not yet exploited. This marks the fourth Chrome zero-day patched in 2026.

Full text

Google has announced a Chrome 146 update that patches 21 vulnerabilities, including a zero-day that has been exploited in the wild. According to an advisory from Google, the latest browser update fixes 19 high-severity and 2 medium-severity issues. The exploited vulnerability is tracked as CVE-2026-5281, and it has been described as a use-after-free issue in Dawn, Chrome’s graphics layer. “Google is aware that an exploit for CVE-2026-5281 exists in the wild,” Google said. Google has not shared information on the attacks exploiting CVE-2026-5281. However, these types of vulnerabilities are often exploited for sandbox escapes or arbitrary code execution. The company has credited an anonymous researcher for reporting the zero-day. The same researcher has also been credited for a different high-severity use-after-free issue in Dawn, but that flaw, tracked as CVE-2026-5284, does not appear to have been exploited in the wild. Advertisement. Scroll to continue reading. This is the fourth Chrome zero-day patched this year, after CVE-2026-2441, CVE-2026-3909, and CVE-2026-3910. All 21 vulnerabilities patched in the latest Chrome update were reported in March, and Google has yet to determine the bug bounties it will pay to the reporting researchers. Related: Chrome 146 Update Patches High-Severity Vulnerabilities Related: Google Plans Two-Week Release Schedule for Chrome Related: Google Working Towards Quantum-Safe Chrome HTTPS Certificates Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. More from Eduard Kovacs Google Slashes Quantum Resource Requirements for Breaking Cryptocurrency EncryptionHealthcare IT Platform CareCloud Probing Potential Data BreachEuropean Commission Reports Cyber Intrusion and Data TheftFBI Confirms Kash Patel Email Hack as US Offers $10M Reward for HackersCISA Flags Critical PTC Vulnerability That Had German Police MobilizedAlleged RedLine Malware Administrator Extradited to USDell and HP Roll Out Quantum-Resistant Device SecurityRussian Cybercriminal Gets 2-Year Prison Sentence in US Latest News Toy Giant Hasbro Hit by CyberattackNew DeepLoad Malware Dropped in ClickFix AttacksFBI Warns of Data Security Risks From China-Made Mobile AppsUS Charges Uranium Crypto Exchange HackerWebinar Today: Agentic AI vs. Identity’s Last Mile ProblemAxios NPM Package Breached in North Korean Supply Chain AttackGoogle Addresses Vertex Security Issues After Researchers Weaponize AI AgentsCensys Raises $70 Million for Internet Intelligence Platform Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Securing Fragile OT in an Exposed World March 10, 2026 Get a candid look at the current OT threat landscape as we move past "doom and gloom" to discuss the mechanics of modern OT exposure. Register Webinar: Why Automated Pentesting Alone Is Not Enough April 7, 2026 Join our live diagnostic session to expose hidden coverage gaps and shift from flawed tool-level evaluations to a comprehensive, program-level validation discipline. Register People on the MoveModerna has promoted Farzan Karimi to Deputy Chief Information Security Officer.Brian Goldfarb has been appointed Chief Marketing Officer at SentinelOne.Token has appointed Katy Nelson as Chief Revenue Officer.More People On The MoveExpert Insights The Next Cybersecurity Crisis Isn’t Breaches—It’s Data You Can’t Trust Data integrity shouldn’t be seen only through the prism of a technical concern but also as a leadership issue. (Steve Durbin) Why Agentic AI Systems Need Better Governance – Lessons from OpenClaw Agentic AI platforms are shifting from passive recommendation tools to autonomous action-takers with real system access, (Etay Maor) The Human IOC: Why Security Professionals Struggle with Social Vetting Applying SOC-level rigor to the rumors, politics, and 'human intel' can make or break a security team. (Joshua Goldfarb) How to 10x Your Vulnerability Management Program in the Agentic Era The evolution of vulnerability management in the agentic era is characterized by continuous telemetry, contextual prioritization and the ultimate goal of agentic remediation. (Nadir Izrael) SIM Swaps Expose a Critical Flaw in Identity Security SIM swap attacks exploit misplaced trust in phone numbers and human processes to bypass authentication controls and seize high-value accounts. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-5281
• cve — CVE-2026-5284
• cve — CVE-2026-2441
• cve — CVE-2026-3909
• cve — CVE-2026-3910