Google has issued urgent updates to address yet another Chrome vulnerability being actively exploited, making this the fourth such security issue fixed this year.

In a security announcement released on Tuesday, Google confirmed that CVE-2026-5281 is being exploited.

According to the Chromium commit history, the vulnerability is due to a use-after-free flaw in Dawn, a cross-platform WebGPU implementation used by Chromium.

The Dawn vulnerability can be exploited by attackers to cause browser freezes, data corruption, display problems, or other unusual behaviors.

Although Google has detected active exploitation of this zero-day vulnerability, details regarding these incidents have not been released.

“Information about the bug and related links may be restricted until most users have received the update. Restrictions will also be applied if the bug exists in a third-party library that other projects rely on but have not yet patched,” the company explained.

Google has now resolved the zero-day vulnerability for users on the Stable Desktop channel, with new versions being distributed to Windows, macOS (146.0.7680.177/178), and Linux users (146.0.7680.177). Google stated that the update could take days or weeks to reach all users; however, it was immediately available when BleepingComputer checked for updates today.

To prompt an immediate update, you can manually check for and install updates, or allow the browser to automatically check for updates upon its next launch.

This marks the fourth Chrome zero-day, actively exploited, that has been patched in the current year. The first (CVE-2026-2441), which was an iterator invalidation bug in CSSFontFeatureValuesMap (Chrome’s CSS font feature values implementation), was fixed by Google in mid-February.

Earlier in the month, Google addressed two additional Chrome zero-day vulnerabilities being exploited: the first was an out-of-bounds write vulnerability in the Skia 2D graphics library (CVE-2026-3909), and the second was an issue concerning improper implementation within the V8 JavaScript and WebAssembly engine (CVE-2026-3910).

In 2025, Google patched a total of eight actively exploited zero-day flaws, many of which were found and reported by Google’s Threat Analysis Group (TAG), which specializes in identifying and investigating zero-day exploits used in spyware attacks.