CVE-2026-5281

This is a “use-after-free” bug inside Chrome’s graphics/rendering code. If an attacker already managed to take control of Chrome’s renderer, they can use a specially crafted web page to make Chrome run attacker-controlled code—like breaking out of a sandbox and getting the browser to do the attacker’s bidding.

This matters if your staff use Google Chrome on endpoints you manage (including Google Chrome on Red OS and Astra Linux). The attack typically needs the attacker to already have compromised the renderer process, and it requires user interaction through a crafted web page.

In practice, the realistic risk is highest when an attacker already has an initial foothold via another browser compromise or similar intrusion path.

This is RED because it is confirmed as actively exploited and is in the CISA KEV catalog, meaning attackers are using it in the real world. CISA lists a specific remediation deadline—treat this as an urgent patching item for all Chrome installations.

Do not wait for symptoms; update Chrome promptly across your business endpoints.

1. Confirm exposure (inventory)

   • On each endpoint that uses Google Chrome, collect the Chrome version: Chrome → Settings → About Chrome.
   • Flag any machines with Google Chrome prior to 146.0.7680.178.

2. Upgrade to the fixed version

   • Upgrade all flagged endpoints to Google Chrome 146.0.7680.178 or later.
   • Use your organization’s standard Chrome update method for each OS. For Red OS and Astra Linux, ensure you’re installing updates from your trusted update sources.

3. Validate after upgrade

   • Re-check versions after patching to confirm the running build is at least 146.0.7680.178.
   • Verify Chrome is receiving updates as expected (no pinned/blocked update policy that would prevent patching).

4. If you cannot patch immediately (workaround)

   • Treat this as a temporary risk window: restrict access to untrusted websites and reduce exposure to risky browsing environments until patching is complete.
   • Strengthen monitoring for browser compromise indicators (unexpected child processes spawned by the browser, unusual high-rate network activity originating from the browser, or repeated renderer crashes followed by suspicious activity).

5. Due date and tracking

   • CISA KEV remediation due date: 2026-04-15. Track completion internally before that date.

6. What to monitor post-change

   • Browser security/endpoint alerts indicating renderer compromise.
   • Any suspicious follow-on behavior (unexpected downloads, credential theft attempts, or new persistence mechanisms).

Severity is High (use-after-free) and CVE-2026-5281 is listed in CISA KEV with an explicit remediation due date (2026-04-15), indicating it is considered actively exploitable in the wild. The affected code is in Dawn within Chromium, and the mechanism is a use-after-free that can be triggered via crafted HTML when the attacker has already compromised the Chrome renderer process; the findings also note user interaction is required. This combination (renderer foothold + crafted content) enables arbitrary code execution, potentially leading to complete compromise of the browser environment. Exploitation status: KEV-listed and reporting indicates it is among actively exploited Chrome zero-days patched in 2026; no public exploit code was found in the provided findings. Actor attribution is mentioned in PULSE as UNC6240 (ShinyHunters).