Google Confirms Chrome Zero-Day Exploit Targeting 3.5 Billion Users — Patch Available Now

Google has issued an urgent security alert for the 3.5 billion users of its Chrome browser after confirming that a newly discovered zero-day vulnerability, tracked as CVE-2026-5281, is already being actively exploited by hackers in the wild. The warning, issued in early April 2026, accompanies a fresh security update that patches this critical flaw alongside 20 additional vulnerabilities discovered across multiple Chrome components.

The U.S. Cybersecurity and Infrastructure Security Agency, better known as CISA, has added CVE-2026-5281 to its official Known Exploited Vulnerabilities catalog and issued a binding directive requiring federal agencies to apply the fix immediately. Security experts are urging all organisations and individual users to treat this update as a priority, regardless of whether they face a legal obligation to do so.

What Makes CVE-2026-5281 Dangerous
The zero-day flaw is classified as a use-after-free memory vulnerability and resides within Dawn, the cross-platform WebGPU component built into Chrome. This type of vulnerability occurs when a programme continues to reference a memory location after that memory has been freed, creating an opening that attackers can exploit.

If successfully triggered, CVE-2026-5281 can cause browser crashes, data corruption, and in the worst case, allow an attacker to execute arbitrary malicious code on a victim’s device through a specially crafted web page. The fact that real-world exploitation has already been confirmed makes this significantly more serious than a theoretical threat.
Google has deliberately limited the technical information it has released publicly. A member of the Chrome security team explained that access to full vulnerability details will remain restricted until most users have received the patch, a standard approach designed to slow down further exploitation while the update rolls out.

CVE-2026-5281 is the fourth Chrome zero-day Google has been forced to patch in the first quarter of 2026 alone, following three earlier flaws addressed in February and March. For context, Google patched a total of eight zero-days across the entire calendar year of 2025, making the current pace notably elevated.

All 21 Chrome Vulnerabilities Fixed in This Update
The latest Chrome security update brings Windows and Mac users to version 146.0.7680.177/178 and Linux users to version 146.0.7680.177. Beyond the zero-day, the update addresses 20 further vulnerabilities spanning a wide range of Chrome components.

Among the high-severity flaws patched are use-after-free vulnerabilities in the CSS, Web MIDI, WebCodecs, WebGL, Dawn, WebView, PDF, Navigation, and Compositing components. Additional fixes cover heap buffer overflow issues in the Chrome GPU and ANGLE components, integer overflow flaws in the Codecs and ANGLE components, and an object corruption vulnerability in the V8 JavaScript engine. Medium-severity issues in WebGL and WebCodecs were also resolved in the same release.

CISA has strongly encouraged all private organisations and individuals to assess their exposure and apply the patch as a matter of urgency, even where no formal compliance deadline applies.

How to Update Google Chrome Right Now
Chrome updates typically install automatically in the background, but waiting for that process can take days or even weeks. Given that active exploitation of CVE-2026-5281 has been confirmed, manually triggering the update is the safest course of action.

To do this, open Chrome and click the three-dot menu in the top right corner of the browser. Select Help, then click About Google Chrome. The browser will immediately check for and begin downloading any available update. Once the download is complete, restart Chrome when prompted to ensure the patch takes full effect and your browser is protected against all 21 vulnerabilities included in this release.

Users who have not applied this update remain potentially exposed to a vulnerability that hackers are already using in active attack campaigns.