Loading story…
Google released Chrome updates to fix 21 vulnerabilities, including CVE-2026-5281, a high-severity zero-day that was exploited in the wild. The flaw is a use-after-free bug in Dawn, Chromium's open-source implementation of the WebGPU standard, and affects Chrome versions prior to 146.0.7680.177/178 on Windows and macOS and prior to 146.0.7680.177 on Linux. Google said the bug could lead to arbitrary code execution if an attacker had already compromised the renderer process and then used a crafted HTML page.
Google withheld detailed information about the attacks, saying access to specifics may remain restricted until more users have updated. The vulnerability was reported by the pseudonymous researcher 86ac1f1587b71893ed2ad792cd7dde32, who has also disclosed other Chrome flaws, and it marks the fourth actively exploited Chrome zero-day patched by Google this year after CVE-2026-3909, CVE-2026-3910, and CVE-2026-2441. Vivaldi had already shipped a fix, while Microsoft Edge was still preparing its corresponding update at the time of reporting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CISA added the actively exploited Chrome/WebGPU flaw CVE-2026-5281 to its Known Exploited Vulnerabilities catalog after Google's disclosure. The agency ordered Federal Civilian Executive Branch agencies to remediate the issue by 2026-04-15 under Binding Operational Directive 22-01.
By the time of reporting, Vivaldi had already released a browser update to address CVE-2026-5281 in its Chromium-based product. Microsoft Edge was still preparing its corresponding update.
Google released Chrome security updates addressing 21 vulnerabilities, including CVE-2026-5281, a high-severity use-after-free flaw in Dawn that had been exploited in the wild. The fixes updated Chrome to 146.0.7680.177/178 on Windows and macOS and 146.0.7680.177 on Linux, with Google withholding detailed exploitation information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcegithub.com
Open sourcedarkwebinformer.com
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released emergency Chrome updates to fix two **high-severity zero-day vulnerabilities**, `CVE-2026-3909` and `CVE-2026-3910`, that are being **exploited in the wild**. Advisory reporting says the flaws can enable **data manipulation** and **security restriction bypass**, prompting a **high-risk** assessment. Google has not disclosed attack details, indicating access to technical information may remain restricted until more users have installed the fixes. Technical reporting identifies `CVE-2026-3909` as an **out-of-bounds write** in **Skia**, Chrome’s graphics library, and `CVE-2026-3910` as an **inappropriate implementation** issue in the **V8 JavaScript and WebAssembly engine**. Google said both were patched within days of being reported, with fixes rolling out to the Stable Desktop channel for **Windows `146.0.7680.75`**, **macOS `146.0.7680.76`**, and **Linux `146.0.7680.75`**. The company warned that full update deployment may take days or weeks, making prompt browser updates important while exploitation is ongoing.
Jun 29, 2026
Google released an urgent **Chrome stable channel** update to address two **high-severity zero-day vulnerabilities** that the company says are being **actively exploited in the wild**. The patched versions are `146.0.7680.75/76` for **Windows and macOS** and `146.0.7680.75` for **Linux**, with rollout occurring over days to weeks. The flaws were reported internally by Google on March 10, and Google said access to additional bug details may remain restricted until most users have updated. The two vulnerabilities are **CVE-2026-3909**, an **out-of-bounds write in Skia**, and **CVE-2026-3910**, an **inappropriate implementation in V8**. Both components are high-value targets because they sit in Chrome’s rendering and JavaScript execution paths, creating opportunities for malicious webpages to trigger memory corruption or unsafe browser behavior that could lead to **arbitrary code execution**. The update is a substantive security release rather than routine product news because Google explicitly confirmed that exploits exist for both issues, making rapid patching a priority for enterprises and end users.
Jun 29, 2026
Google Chrome fixed two high-severity use-after-free vulnerabilities in the **Dawn** component, tracked as **`CVE-2026-5281`** and **`CVE-2026-5286`**, in versions prior to **`146.0.7680.178`**. Both flaws could let a remote attacker trigger **arbitrary code execution** via a crafted HTML page, with one advisory noting exploitation after compromise of the renderer process and the other describing user-driven page loading as the attack path. Both CVEs are classified as **`CWE-416`** and carry the same **CVSS v3.1** vector, **`AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`**, reflecting high impact to confidentiality, integrity, and availability. The records were updated with severity details and references to Chrome release notes and Chromium issue tracker entries, underscoring the need for organizations to move Chrome deployments to **`146.0.7680.178`** or later.
Jun 29, 2026