Chrome CVE-2026-5284

Requires Google Chrome prior to 146.0.7680.178. Attacker must first compromise the renderer process, then trick user into opening a crafted HTML page. Remote exploitation with user interaction needed.

While CVSS score and vector data are unavailable for direct assessment, the Chromium security team assigned 'High' severity classification, and the combination of factors indicates moderate real-world exploitability with important caveats: (1) exploitation requires prior renderer process compromise, significantly raising the attack bar compared to unauthenticated remote RCE; (2) use-after-free vulnerabilities are reliably exploitable but require precise trigger conditions and heap feng shui, reducing practical impact; (3) Chrome's sandboxing architecture means RCE within renderer does not directly compromise the system unless chained with sandbox escape; (4) vendor has released a patched version, reducing urgency only for organizations that can deploy updates rapidly. The primary risk is in targeted attacks against high-value targets where renderer compromise is already possible, or in multi-vulnerability exploit chains.

An attacker must first compromise the Chrome renderer process through a separate vulnerability (e.g., memory safety flaw in JavaScript engine or HTML/CSS parsing), then serves a specially crafted HTML page to the already-compromised renderer. The malicious page triggers the use-after-free condition in Dawn's graphics processing, allowing the attacker to execute arbitrary code within the renderer process sandbox. In practical targeted attacks, this would be chained with a sandbox escape vulnerability to gain system-level code execution; no public exploit code has been identified at the time of analysis, and the vulnerability does not appear on CISA's Known Exploited Vulnerabilities catalog, indicating no confirmed active exploitation in the wild.