Severity: High (NVD)
Summary
Google has released a Stable Channel security update for Chrome Desktop addressing CVE-2026-5281, a high-severity vulnerability in Dawn. Google states that an exploit for this issue exists in the wild. (Chrome Releases)
Organizations using Google Chrome should review affected versions, apply the latest security update, and verify that managed endpoints are running the patched release.
Affected Products
Impacted Google Chrome products may include:
• Google Chrome for Windows
• Google Chrome for macOS
• Google Chrome for Linux
Risk depends on installed version, patch level, and whether systems remain on unpatched desktop releases. (Chrome Releases)
Vulnerability Overview
• CVE ID: CVE-2026-5281 (NVD)
• Type: Use-after-free in Dawn (WebGPU) (NVD)
• CVSS Score: 8.8 (HIGH) — refer to official CVE/vendor records (CVE Details)
• Condition: Systems running Chrome desktop versions prior to the patched Stable release (NVD)
Google’s March 31, 2026 Stable Channel update identifies patched versions as 146.0.7680.177/178 for Windows and macOS, and 146.0.7680.177 for Linux. The issue was reported on March 10, 2026. (Chrome Releases)
Observed Activity
According to Google (and downstream reporting), real-world exploitation has included:
• An exploit for CVE-2026-5281 exists in the wild (Chrome Releases)
• The issue affects Dawn, Chrome’s WebGPU component (NVD)
• Public bug details may remain restricted until a majority of users are updated (Chrome Releases)
• CISA KEV: Reported as added to the Known Exploited Vulnerabilities (KEV) Catalog with an action due date of April 15, 2026 (note: direct CISA page access is blocked in this environment, so this is sourced from secondary listings/reporting). (CVE Details)
Recommended Actions
We strongly recommend the following immediate steps:
• Update Google Chrome Desktop to the latest Stable Channel release. (Chrome Releases)
• Verify endpoint browser versions across Windows, macOS, and Linux systems. (Chrome Releases)
• Enable automatic browser updates where possible.
• Review security monitoring for unusual browser-related activity.
Our Status
DataComm is reviewing affected systems and validating Chrome version compliance in accordance with vendor guidance. Customers requiring assistance are encouraged to contact our support team.
Support: support@www-prod.datacomm.com
Phone: (877) 544-3655
References
• Chrome Releases – Stable Channel Update for Desktop (March 31, 2026) (Chrome Releases)
• Chromium Issue Tracker – Issue 491518608 (Chrome Releases)
• CVE Record – CVE-2026-5281 (NVD) (NVD)
