Loading story…
Google Chrome fixed two high-severity use-after-free vulnerabilities in the Dawn component, tracked as CVE-2026-5281 and CVE-2026-5286, in versions prior to 146.0.7680.178. Both flaws could let a remote attacker trigger arbitrary code execution via a crafted HTML page, with one advisory noting exploitation after compromise of the renderer process and the other describing user-driven page loading as the attack path.
Both CVEs are classified as CWE-416 and carry the same CVSS v3.1 vector, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting high impact to confidentiality, integrity, and availability. The records were updated with severity details and references to Chrome release notes and Chromium issue tracker entries, underscoring the need for organizations to move Chrome deployments to 146.0.7680.178 or later.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE entries were updated with vulnerability descriptions, CWE-416 classification, CVSS v3.1 scoring, and references to Chrome release notes and Chromium issue tracker entries. Both vulnerabilities were classified by Chromium as High severity.
Google addressed CVE-2026-5281 and CVE-2026-5286, two high-severity use-after-free vulnerabilities in Dawn, in Google Chrome version 146.0.7680.178. The flaws could allow arbitrary code execution via a crafted HTML page, with CVE-2026-5281 requiring prior renderer compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Chrome addressed three **use-after-free** vulnerabilities tracked as `CVE-2026-7347`, `CVE-2026-7363`, and `CVE-2026-7344` in versions prior to `147.0.7727.138`. The bugs affect the **Chromoting**, **Canvas**, and **Accessibility** components, respectively, and all were classified under `CWE-416`. Two of the flaws were rated **critical**: `CVE-2026-7363` allows a remote attacker to execute arbitrary code inside the browser sandbox on Linux and ChromeOS by luring a user to a crafted HTML page, while `CVE-2026-7344` could let an attacker escape Chrome's sandbox on Windows after compromising the renderer process via crafted web content. The third issue, `CVE-2026-7347`, was rated **high severity** and affects Chromoting, where malicious network traffic could enable arbitrary code execution without privileges or user interaction. CVSS data added to the records shows network-based exploitation with high impact to confidentiality, integrity, and availability, with `CVE-2026-7363` and `CVE-2026-7344` carrying the vector `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`. The vulnerabilities were documented in Chrome and Chromium tracking references, underscoring the need for organizations to move affected browsers to `147.0.7727.138` or later.
Jun 29, 2026
Google Chrome disclosed two high-severity use-after-free vulnerabilities, **`CVE-2026-6316`** in the **Forms** component and **`CVE-2026-6360`** in the **FileSystem** component. Both flaws affect Chrome versions prior to **`147.0.7727.101`** and can be triggered by a remote attacker using a crafted HTML page. In the Forms bug, successful exploitation could lead to arbitrary code execution inside the browser sandbox, while the FileSystem bug could enable exploitation through object corruption. Both issues are classified as **`CWE-416`** and carry a **CVSS v3.1** rating of **`AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`**, reflecting high impact to confidentiality, integrity, and availability with no privileges required beyond user interaction. Chromium rated each vulnerability as **High** severity and published fixes in Chrome **`147.0.7727.101`**, with references pointing to Chrome release notes and Chromium issue tracker entries.
Jun 29, 2026
Google released Chrome updates to fix 21 vulnerabilities, including **CVE-2026-5281**, a high-severity zero-day that was exploited in the wild. The flaw is a use-after-free bug in **Dawn**, Chromium's open-source implementation of the **WebGPU** standard, and affects Chrome versions prior to `146.0.7680.177/178` on Windows and macOS and prior to `146.0.7680.177` on Linux. Google said the bug could lead to arbitrary code execution if an attacker had already compromised the renderer process and then used a crafted HTML page. Google withheld detailed information about the attacks, saying access to specifics may remain restricted until more users have updated. The vulnerability was reported by the pseudonymous researcher `86ac1f1587b71893ed2ad792cd7dde32`, who has also disclosed other Chrome flaws, and it marks the fourth actively exploited Chrome zero-day patched by Google this year after **CVE-2026-3909**, **CVE-2026-3910**, and **CVE-2026-2441**. **Vivaldi** had already shipped a fix, while **Microsoft Edge** was still preparing its corresponding update at the time of reporting.
Jun 29, 2026