Exploited· due 2026-04-15

CVE-2026-5281

Google Dawn

Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Exploitation status

  • CISA has confirmed this is being exploited in the wild. That is an observation of real attacks, not a prediction.
  • US federal civilian agencies are required to remediate it by 2026-04-15. That deadline does not bind private companies, but it is a reasonable benchmark for how urgently CISA views it.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA’s wording, unedited.

Scoring

CVSS
Not yet scored

Dates

Published
2026-04-01
Added to KEV
2026-04-01
Remediation due
2026-04-15
Sources
CISA KEV