Google's Fourth Chrome Zero-Day of 2026 Was Hiding in a Graphics Feature You've Never Heard Of

What Happened

On April 1, 2026, Google released a Chrome update that patched 21 security vulnerabilities. Buried among them was CVE-2026-5281, a high severity use after free bug in Dawn, the open source library that implements the WebGPU standard in Chromium based browsers. Google confirmed an exploit for the flaw already existed in the wild.

Hours later, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-5281 to its Known Exploited Vulnerabilities (KEV) catalog, giving federal agencies until April 15 to apply the fix.

How the Exploit Works

WebGPU is the successor to WebGL. It gives websites direct access to a device's graphics hardware for tasks like 3D rendering, machine learning inference, and compute heavy visual effects. Dawn is the C++ library that Chrome uses under the hood to translate WebGPU API calls into platform specific GPU commands.

A use after free occurs when a program continues referencing a chunk of memory after it has been deallocated. In Dawn's case, an attacker who had already compromised the renderer process could trigger faulty memory management in the GPU pipeline, corrupt memory, and escalate to arbitrary code execution, all from a single crafted HTML page.

Google withheld technical details to buy time for users to update, but security researchers noted the attack surface is significant: any Chromium based browser that ships Dawn, including Microsoft Edge, Brave, Vivaldi, and Opera, is potentially affected.

Four Zero-Days in Four Months

CVE-2026-5281 is the fourth actively exploited Chrome zero-day Google has patched since January. We covered the first three earlier this year:

• February 2026 — CVE-2026-2441, a use after free in Chrome's CSS engine
• March 2026 — CVE-2026-3909 (CVSS 8.8), an out of bounds write in Skia, Chrome's 2D graphics library
• March 2026 — CVE-2026-3910 (CVSS 8.8), a flaw in V8, Chrome's JavaScript and WebAssembly engine
• April 2026 — CVE-2026-5281, the Dawn/WebGPU use after free

The pattern is telling. Two of the four vulnerabilities target graphics subsystems (Skia and Dawn), and all four are memory safety issues, the class of bugs that Rust and other memory safe languages are designed to prevent. Google has been investing heavily in rewriting critical Chrome components in Rust, but the graphics stack has not yet been converted.

A Pseudonymous Researcher With a Track Record

The vulnerability was reported by a bug hunter identified only by the hash 86ac1f1587b71893ed2ad792cd7dde32. The same researcher had previously reported two other Dawn and WebGL vulnerabilities (CVE-2026-4675 and CVE-2026-4676) that Google fixed on March 23. Three critical GPU related bugs in under two weeks from a single researcher suggests a focused fuzzing campaign against Chrome's graphics layer.

Who Is at Risk

Anyone running a Chromium based browser on Windows, macOS, or Linux. That includes Chrome, Edge, Brave, Vivaldi, Opera, and Arc. Vivaldi shipped a fix the same day as Google. Microsoft Edge was still working on its patch at the time of publication.

The practical attack scenario requires a user to visit a malicious or compromised webpage. Given the exploit already exists in the wild, this is not theoretical. Drive by attacks through malvertising or phishing links that lead to exploit pages are the most likely delivery mechanism.

What You Should Do Now

• Update Chrome immediately. Go to chrome://settings/help and confirm you are on version 146.0.7680.177 or later (146.0.7680.178 on macOS).
• Update other Chromium browsers. Edge, Brave, Vivaldi, and Opera all share the Dawn codebase. Check each browser's update channel.
• Restart your browser. Chrome downloads updates in the background, but the fix only takes effect after a restart.
• Be cautious with links. Until you have confirmed the update, treat unfamiliar links in emails and messages with extra suspicion. A single click on a crafted page is enough to trigger the exploit.

The Bigger Picture

Four zero-days in four months is an accelerating pace. In 2025, Google patched roughly one actively exploited Chrome zero-day per month across the full year. 2026 is on track to match or exceed that rate, and the year is only a quarter old.

The concentration in graphics subsystems is worth watching. As browsers become platforms for AI workloads, gaming, and creative tools, WebGPU's attack surface will only grow. Security teams should monitor CISA's KEV catalog and treat Chrome updates with the same urgency as operating system patches.

Browser vulnerabilities like this one are also a reminder that your inbox is only as safe as the software you use to read it. A malicious link in a phishing email that exploits a browser zero-day can compromise your entire system before any email security tool has a chance to intervene. Keeping your browser patched is one of the most effective defenses against email based threats.