High

Use-after-free in Dawn in Google Chrome

IdentifiersCVE-2026-5284CWE-416· Use After Free

CVE-2026-5284 is a high-severity use-after-free vulnerability in Dawn, Chromium/Chrome’s WebGPU implementation. According to the provided description, affected versions are Google Chrome prior to 146.0.7680.178. The flaw allows a remote attacker who has already compromised the renderer process to execute arbitrary code via a crafted HTML page. Publicly available detail in the provided content is limited, but the bug is explicitly identified as a memory-lifetime error in the Dawn component.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can lead to arbitrary code execution. Based on the provided description, the attacker must already control or have compromised the renderer process, after which the vulnerability can be used via a crafted HTML page to achieve further code execution, likely across a Chrome security boundary involving the graphics/WebGPU stack.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure by limiting use of vulnerable Chrome builds and applying vendor updates as soon as available. Given the flaw is in Dawn/WebGPU, reducing access to the affected browser component may lower risk, but no specific vendor-endorsed mitigation for CVE-2026-5284 was provided in the supplied content.

Remediation

Patch, then assume compromise.

Update Google Chrome to version 146.0.7680.178 or later. Because Dawn is part of Chromium, downstream Chromium-based browsers should also be updated once vendor fixes incorporating the upstream patch are available.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

GoogleChromeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

12 SOURCESView more in app

zeropath blogNews

Apr 15, 2026

Google Chrome Dawn WebGPU Use After Free: Brief Summary of CVE-2026-6310 and Its Sandbox Escape Potential - ZeroPath Blog | ZeroPath

An earlier 2026 Dawn/WebGPU use-after-free vulnerability in Chrome referenced as part of a series of related flaws patched in Chrome 146 updates.

forbesNews

Apr 3, 2026

Google Issues Zero-Day Attack Alert For 3.5 Billion Chrome Users

A high-rated use-after-free vulnerability in Chrome's Dawn component.

cyber security newsNews

Apr 1, 2026

New Chrome Zero-Day Vulnerability Actively Exploited in Attacks - Patch Now

A use-after-free vulnerability in Chrome Dawn component patched in this release.

help net securityNews

Apr 1, 2026

Google fixes Chrome zero-day with in-the-wild exploit (CVE-2026-5281) - Help Net Security

A use-after-free vulnerability in Dawn fixed in the current Chrome update.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-5284

NVD

nvd.nist.gov/vuln/detail/CVE-2026-5284

MITRE CWE · CWE-416

Use After Free

Vendor Advisory

chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html

Issue Tracking

issues.chromium.org/issues/492139412