Chrome's zero-day on WebGPU: what happens and how to protect yourself

The recent vulnerability Chrome's zero-day on WebGPU This has set off alarm bells in the cybersecurity world. We're not talking about a minor flaw, but a critical bug in Dawn, the layer Chrome uses to communicate with the GPU via the new WebGPU standard, and it's being actively exploited by attackers. If you use Chrome or any Chromium-based browser, this directly affects you.

Google has had to launch a emergency security update To close this vulnerability, officially cataloged as CVE-2026-5281. The problem not only allows the browser to crash, but also opens the door to code execution and, potentially, bypassing the browser sandbox from a simple malicious website. If you haven't yet checked your browser version, now is the time.

What is Chrome's zero-day vulnerability in WebGPU (CVE-2026-5281)?

The vulnerability that has triggered all the alerts is identified as CVE-2026-5281This is a use-after-free vulnerability in Dawn, the library that implements WebGPU in Chromium. In simpler terms, the browser continues to use a portion of memory after it has been freed, which in a sensitive component like the graphics layer can lead to memory corruption and arbitrary code execution.

This bug directly impacts Dawn, the GPU abstraction Used by Chrome and other Chromium-based browsers, Dawn translates WebGPU API calls into specific GPU instructions for each platform. If this layer mismanages memory, an attacker can exploit this weakness to manipulate internal data and take control of the browser process.

The ruling is being actively exploited “in the wild”This is something Google has explicitly acknowledged in its security advisory. This means we're not dealing with a theoretical bug discovered in a lab, but a real exploit already being used in attacks, presumably through malicious websites or compromised legitimate sites.

For all these reasons, Google has classified the problem as very high criticality within its bulletin, and several agencies such as CISA have immediately added it to their catalogs of known exploited vulnerabilities, imposing strict deadlines on public administrations to patch it.

From a technical point of view, use-after-free in Dawn allows, after manipulating the flow of the graphics pipeline, corrupt memory structures associated with the rendering process. With proper engineering, this can be chained together to execute arbitrary code, escape the sandbox, or at least cause controlled browser crashes that serve as a foothold for other attacks.

Google maintains restricted technical details about the bug and the exploit used. This is the usual strategy: details are hidden until a critical mass of users have updated, making it difficult for other threat actors to easily replicate the attack while the patch is being distributed.

Chrome update and affected versions

To contain the impact of the zero-day vulnerability on WebGPU, Google has published a urgent Chrome update This update upgrades the browser to version 146.0.7680.177/178, depending on the platform. It is a priority security update, not a routine release, and it fixes a total of 21 vulnerabilities, including CVE-2026-5281.

The affected versions include the Chrome Stable Channel on various operating systems. Specifically, all versions prior to the following are considered vulnerable:

• Chrome Stable < 146.0.7680.177 on Linux.
• Chrome Stable < 146.0.7680.178 on Windows and macOS.

The internal bulletin also mentions the line of versions intended for corporate environments and specific distributions, but the practical message is clear: if your browser has not reached at least the branch 146.0.7680.177/178, is considered exposed.

The update not only fixes the zero day issue in Dawn, but also addresses 21 security flaws in totalMost of these vulnerabilities are of high severity. However, CVE-2026-5281 stands out because it is actively being exploited and affects a component as sensitive as direct GPU interaction via WebGPU.

It's important to remember that Chrome downloads background updatesHowever, these updates don't take full effect until the browser is restarted. Many people think they're protected simply because Chrome updates automatically, when in reality they may have been using the browser for days without restarting and the patch hasn't finished installing.

Other bugs fixed alongside the zero-day exploit in WebGPU

The version that fixes Chrome's zero-day vulnerability on WebGPU comes with a good handful of patches In total, Google has acknowledged 21 vulnerabilities addressed in this round, with memory issues in various parts of the browser playing a prominent role.

Among the high severity failures are multiple use-after-free and buffer overflows in critical components. The simplified list of relevant vulnerabilities includes, among others, the following:

• CVE-2026-5273: use-after-free in the CSS engine.
• CVE-2026-5272: buffer overflow in the GPU component.
• CVE-2026-5274: integer overflow in the codecs module.
• CVE-2026-5275: heap buffer overflow in ANGLE (graphics compatibility layer).
• CVE-2026-5276: insufficient enforcement policy in WebUSB.
• CVE-2026-5278: use-after-free on Web MIDI.
• CVE-2026-5279: corruption of objects in the V8 engine.
• CVE-2026-5280: use-after-free in WebCodecs.
• CVE-2026-5284: new use-after-free in Dawn.
• CVE-2026-5285: use-after-free in WebGL.
• CVE-2026-5287: use-after-free in the PDF renderer.
• CVE-2026-5288: use-after-free in WebView.
• CVE-2026-5289: use-after-free in the navigation layer.
• CVE-2026-5290: use-after-free in the composition pipeline.

As you can see, a large part of the problems are concentrated in rendering and graphics subsystemsGPU, WebGL, Dawn, ANGLE, PDF, WebView, CSS… These areas have historically been a goldmine for researchers and attackers, due to the complexity of their logic and the constant interaction with untrusted data from web pages.

Also noteworthy is the presence of vulnerabilities in V8 (the JavaScript and WebAssembly engine) and in technologies associated with multimedia and devices such as WebCodecs, WebUSB, or WebMIDI. Any of these, combined with the zero-day release of WebGPU, could form part of more sophisticated exploitation chains.

In addition to these high-severity flaws, Google points out two vulnerabilities in Intermediate level in WebGL and WebCodecsAlthough their isolated impact may be smaller, in the current ecosystem attackers often combine vulnerabilities of different levels to build more reliable exploits and bypass platform protections.

Chrome's recent zero-days and attack pattern

The case of CVE-2026-5281 is not an isolated incident. It is already the Chrome's fourth zero day which Google has fixed so far this year, making it clear that the browser is under constant pressure from advanced threat actors, often linked to spyware campaigns or targeted attacks.

The other vulnerabilities actively exploited in 2026 are:

• CVE-2026-2441: use-after-free in the CSS part (CSSFontFeatureValuesMap), patched in mid-February.
• CVE-2026-3909: out-of-bounds write in Skia, Chrome's 2D graphics library, with a CVSS of 8,8.
• CVE-2026-3910: failure in the implementation of the V8 JavaScript engine and WebAssembly, also with CVSS 8,8.

The pattern that emerges is quite clear: memory vulnerabilities (use-after-free, out-of-bounds, overflows) that primarily affect the graphics layer (Skia, Dawn) and the code execution engine (V8). These are essentially the types of bugs that languages ​​like Rust attempt to avoid through their memory safety model.

Google has been promoting the Rewriting critical Chrome components in RustThis is precisely to minimize these types of errors. However, the graphics stack and certain parts of the browser still rely on large amounts of legacy C/C++ code, where finding memory bugs with fuzzers and advanced techniques has become almost a high-level sport among researchers and attack groups.

In the specific case of Dawn and WebGL, a researcher identified solely by the hash 86ac1f1587b71893ed2ad792cd7dde32 It has reported several critical vulnerabilities in a very short time, including CVE-2026-4675 and CVE-2026-4676, which were patched by the end of March. Three major flaws in the GPU area within such a short timeframe point to a highly targeted analysis and fuzzing campaign on this subsystem.

Beyond browsers, the overall situation is also discouraging: other serious zero-day vulnerabilities are circulating, such as a Windows exploit nicknamed BlueHammer capable of elevating privileges to SYSTEM in less than a minute without a patch available. All of this reinforces the idea that the rate of discovery and exploitation of critical vulnerabilities is not going to slow down in the short term.

Practical risks of zero-days in WebGPU

From a user or organizational perspective, the worrying aspect is what an attacker can gain from this vulnerability. In the case of CVE-2026-5281, the bug in Dawn gives attackers a direct route from a malicious website towards code execution in the browser context, without the need for extra interaction beyond visiting the page.

WebGPU is essentially the modern successor to WebGL. Its goal is to allow web pages to efficiently access the GPU For 3D rendering, heavy visual effects, AI model inference, and computationally intensive tasks. This power also translates into a considerable attack surface: any error in how resources, command queues, or buffers are managed can have serious consequences.

In this case, an attacker who already controls the rendering process, or who manages to guide it to a specific state through carefully crafted HTML and JavaScript, can force corrupt memory conditions in the GPU pipeline. From there, the step to execute arbitrary code, escalate privileges within the browser, or bypass sandbox protections is a real possibility.

The typical exploitation scenario would be a drive-by attackThe user arrives at a malicious page (or a legitimate site that has been compromised) through a phishing campaign, social media links, malicious ads (malvertising), or instant messaging messages. Simply loading the page is enough for the exploit to attempt to take advantage of the vulnerability in Dawn.

In corporate environments, the combination of this vulnerability with other flaws in the operating system or installed applications can facilitate the lateral movement within the netThis includes the theft of credentials or the distribution of spyware and remote access tools. This is especially critical in organizations that handle confidential information, public administrations, or companies with sensitive customer data.

Affected browsers and platforms

Although the focus is on Google Chrome, the reality is that Chromium codebase It is reused in many other browsers. Dawn, the component that implements WebGPU, is part of that common base, so the impact of CVE-2026-5281 is not limited to just Google's browser.

The browsers potentially affected until they are updated include:

• Google Chrome (all variants based on Chromium Stable).
• Microsoft Edge, which shares much of the Chromium base.
• Brave, focused on privacy but powered by the same engine.
• Vivaldi, which already announced a quick update after the Google patch.
• Opera and Arcamong other browsers that rely on Chromium.

Regarding operating systems, the failure affects users of Windows, macOS and LinuxThe Dawn component runs on all these platforms, adapting WebGPU calls to the corresponding graphics backend. The main difference lies in the version numbering: the 146.0.7680.177 branch covers Linux, while on Windows and macOS it corresponds to 146.0.7680.177 or 146.0.7680.178 depending on the distribution.

CISA has gone further by including CVE-2026-5281 in its catalog of Known Exploited Vulnerabilities (KEV)The US federal agencies were given a deadline (April 15) to apply the patch. This measure underscores that this is not a minor bug, but a vulnerability being actively exploited in real-world campaigns.

It is also worth noting that many applications integrate embedded browsers based on WebView or Chromium enginesIf these applications are not updated at the same pace as the main browser, they could continue to carry vulnerable versions and become a less obvious attack vector.

Recommendations and mitigation measures

On a practical level, the most important measure is update your browser as soon as possibleLetting the automatic process run can result in a delay of days or even weeks, during which time the browser remains vulnerable to active exploits.

In the case of Chrome, it is recommended to go manually to chrome: // settings / help (or Menu > Help > About Google Chrome) and check the installed version. At a minimum, it should show branch 146.0.7680.177 on Linux and 146.0.7680.177/178 on Windows and macOS. If the browser starts downloading an update, wait for it to finish and then restart it completely.

For other Chromium-based browsers, it's worth checking their proprietary update channels and apply the patches as soon as they become available. Edge, Brave, Vivaldi, and Opera have been issuing notices as they integrate the Chromium changes, so it's crucial to ensure that no browser has been left unupdated.

In business or public administration environments, the ideal way to distribute the patch is through centralized policies (GPOs in Windows, endpoint management tools, MDM solutions, etc.). This avoids relying on each user to update individually and allows for centralized verification of the fleet's patch level.

While the update is being completed, and in general, it makes sense to reinforce the digital hygiene measures Basics: exercise extreme caution with links received by email or messaging, limit access to unknown sites, Avoid installing extensions from dubious sources and control the use of external devices that can open web content.

The organizations that process especially sensitive informationLike many companies and organizations in Latin America, they should treat browser patches with the same urgency as operating system patches. Browsers are currently the primary entry point for phishing attacks, malware, and the exploitation of remote vulnerabilities.

Finally, it is advisable to establish an internal process for monitor official sources such as Chrome Releases, CISA advisories (KEV catalog), or manufacturer bulletins. Being informed a few days in advance can make the difference between being vulnerable during a critical window or getting ahead of the wave of massive exploitation.

The Chrome zero-day vulnerability in WebGPU illustrates the extent to which modern browsers have become a key component of any system's security: a simple memory failure in a graphics component like Dawn can open a direct path from a web page to code execution on the computer, and the only realistic defense for most users is to keep the browser rigorously updated and assume that every new critical patch deserves immediate attention.

Related articles:

Serious vulnerability discovered in Chrome exploited by cyberattackers

Isaac

Passionate writer about the world of bytes and technology in general. I love sharing my knowledge through writing, and that's what I'll do on this blog, show you all the most interesting things about gadgets, software, hardware, tech trends, and more. My goal is to help you navigate the digital world in a simple and entertaining way.