Google Patches Critical Chrome Zero-Day CVE-2024-4671 Actively Exploited

Key Takeaways

• Google has issued an emergency security update for its Chrome browser to address an actively exploited zero-day vulnerability.
• The critical flaw, tracked as CVE-2026-5281, is a use-after-free bug in Chrome’s Dawn component, potentially allowing arbitrary code execution.
• Users on Windows, Mac, and Linux are affected and urged to update to Chrome version 146.0.7680.177/178 immediately.
• The update also includes fixes for 20 additional security vulnerabilities, 19 of which are rated high severity.

Google has deployed an urgent security patch for its Chrome browser, responding to a critical zero-day vulnerability, CVE-2026-5281, which is currently under active exploitation in real-world attacks. This emergency update underscores the persistent threat landscape faced by internet users.

The company has rolled out updated versions to the Stable channel: 146.0.7680.177/178 for Windows and macOS, and 146.0.7680.177 for Linux. These updates are progressively reaching users and are expected to propagate fully over the coming days and weeks.

Understanding CVE-2026-5281

The vulnerability at the heart of this emergency release, CVE-2026-5281, is classified as a use-after-free bug within Dawn, Chrome’s cross-platform GPU abstraction layer that facilitates WebGPU. Use-after-free vulnerabilities are a dangerous class of memory corruption flaws. They arise when a program attempts to access memory that has already been deallocated, potentially leading to system crashes, arbitrary code execution, or the ability to escape browser sandboxing mechanisms.

Google has officially acknowledged the active exploitation of this flaw, confirming that it “is aware that an exploit for CVE-2026-5281 exists in the wild.” The vulnerability was initially identified and reported to Google by an anonymous researcher on March 10, 2026. Consistent with its security protocols, Google is withholding detailed technical information about the flaw to prevent further exploitation until a substantial portion of the user base has applied the patch.

Extensive Security Update: 21 Vulnerabilities Addressed

Beyond the critical zero-day, this latest Chrome update incorporates a substantial package of 21 security fixes. This unusually large batch points to significant ongoing internal security efforts by Google. Nineteen of these additional vulnerabilities are rated as High severity, affecting a diverse array of Chrome subsystems.

Several notable high-severity vulnerabilities patched in this release include:

• CVE-2026-5273 — A use-after-free vulnerability impacting CSS (reported March 18).
• CVE-2026-5272 — A heap buffer overflow in the GPU component (reported March 11).
• CVE-2026-5274 — An integer overflow issue found in Codecs (reported March 1).
• CVE-2026-5275 — A heap buffer overflow affecting ANGLE (reported March 4).
• CVE-2026-5276 — Insufficient policy enforcement within WebUSB (reported March 4).
• CVE-2026-5278 — A use-after-free vulnerability in Web MIDI (reported March 6).
• CVE-2026-5279 — An object corruption flaw in the V8 JavaScript engine (reported March 8).
• CVE-2026-5280 — A use-after-free vulnerability in WebCodecs (reported March 11).
• CVE-2026-5284 — Another use-after-free vulnerability in Dawn (reported March 12).
• CVE-2026-5285 — A use-after-free vulnerability in WebGL (reported March 13).
• CVE-2026-5287 — A use-after-free vulnerability affecting PDF rendering (reported March 21).
• CVE-2026-5288 — A use-after-free vulnerability in WebView (reported by Google, March 23).
• CVE-2026-5289 — A use-after-free vulnerability related to Navigation (reported by Google, March 25).
• CVE-2026-5290 — A use-after-free vulnerability in Compositing (reported by Google, March 25).

The prevalence of use-after-free vulnerabilities across critical components like Dawn, WebGL, WebCodecs, Web MIDI, WebView, Navigation, and Compositing highlights persistent memory safety challenges within modern browser rendering pipelines. Notably, Google’s internal security teams were responsible for reporting three of the high-severity patches, indicating proactive threat hunting efforts alongside external disclosures.

Users running Chrome versions prior to 146.0.7680.177 on Linux or 146.0.7680.178 on Windows and macOS are at risk. Given the confirmed active exploitation of CVE-2026-5281, this update should be considered a top priority for all users, particularly enterprise security teams.

What You Should Do

• Update Immediately: Open Google Chrome, navigate to the Menu (⋮) -> Help -> About Google Chrome. The browser will automatically check for and apply the latest update. Restart Chrome when prompted to finalize the installation.
• Verify Version: Ensure your Chrome browser is updated to version 146.0.7680.177 or higher for Linux, and 146.0.7680.177/178 or higher for Windows and macOS.
• Enterprise Deployment: Organizations managing Chrome deployments through policy should push this critical update via their endpoint management platforms without delay.
• Stay Vigilant: Always keep your browser and operating system updated to protect against the latest threats.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.