Critical Zero-Day Vulnerability in Google Chrome Exploited in the Wild A newly discovered zero-day vulnerability in Google Chrome, tracked as CVE-2026-5281, is under active exploitation, posing severe risks to users globally. The flaw, a Use-After-Free (UAF) bug in Google Dawn an open-source WebGPU implementation allows attackers to bypass security protections and execute arbitrary code on affected systems. The vulnerability was added to the Known Exploited Vulnerabilities (KEV) catalog on April 1, 2026, prompting urgent calls for updates. Exploitation requires tricking a victim into visiting a malicious HTML page, which triggers the UAF bug, enabling attackers to compromise the system, steal data, or deploy malware. For enterprises, a single compromised browser could serve as an entry point for lateral movement across networks. While the advisory focuses on Google Chrome, the flaw affects all Chromium-based browsers, including Microsoft Edge, Opera, Vivaldi, and Brave, due to its presence in the underlying engine. Security researchers have not yet confirmed whether the vulnerability is being used in ransomware campaigns, but its active exploitation elevates it to a high-priority threat. The Cybersecurity and Infrastructure Security Agency (CISA) has mandated Federal Civilian Executive Branch (FCEB) agencies to mitigate the risk by April 15, 2026, under Binding Operational Directive (BOD) 22-01. Organizations and users are advised to apply vendor-provided patches immediately, prioritize browser updates in patch management cycles, and discontinue use of unpatched versions if mitigations are unavailable.