Description
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Published: 2026-04-01
Score: 8.8 High
EPSS: 5.0% Low
KEV: Yes
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free flaw in the Dawn graphics engine of Google Chrome allows an attacker who can subvert the renderer process to run arbitrary code; the bug is identified as CWE‑416 and CWE‑825 and requires a malicious HTML page to trigger the freed memory usage.

Affected Systems

All Chrome builds older than 146.0.7680.178 across macOS, Linux, and Windows are affected as indicated by the CPE entries.

Risk and Exploitability

The CVSS score of 8.8 reflects high severity while the EPSS score of 5% suggests the vulnerability may be actively exploited. The entry is listed in the CISA KEV catalog, confirming real‑world attacks. Based on the description, it is inferred that the attack vector is remote content delivered via a malicious web page that causes the renderer to process crafted data, enabling the use‑after‑free.

Generated by OpenCVE AI on June 18, 2026 at 09:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 146.0.7680.178 or later, which contains the patch for the Dawn use‑after‑free bug.
  • Enable automatic updates in Chrome so future security fixes are applied without manual intervention.
  • Use Chrome’s safe browsing and content filtering features to block potentially unsafe web pages until a patch is available.

Generated by OpenCVE AI on June 18, 2026 at 09:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6192-1 chromium security update
History

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Title chromium-browser: Use after free in Dawn
First Time appeared Apple
Apple macos
Google
Google chrome
Linux
Linux linux Kernel
Microsoft
Microsoft windows
Weaknesses CWE-825
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Google
Google chrome
Linux
Linux linux Kernel
Microsoft
Microsoft windows
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

kev

{'dateAdded': '2026-04-01T00:00:00+00:00', 'dueDate': '2026-04-15T00:00:00+00:00'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

threat_severity

Important

Wed, 01 Apr 2026 05:00:00 +0000

Type Values Removed Values Added
Description Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-04-02T03:55:36.436Z

Reserved: 2026-03-31T20:07:13.272Z

Link: CVE-2026-5281

cve-icon Vulnrichment

Updated: 2026-04-01T13:43:48.752Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-01T05:16:01.440

Modified: 2026-06-17T10:58:44.490

Link: CVE-2026-5281

cve-icon Redhat

Severity : Important

Publid Date: 2026-03-31T00:00:00Z

Links: CVE-2026-5281 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-18T09:45:15Z

Weaknesses