Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution (CVE-2026-5281 Actively Exploited)

Executive Summary

MS-ISAC Advisory 2026-028 (issued 4/1/2026): multiple vulnerabilities in Google Chrome, the most severe of which could allow for arbitrary code execution via drive-by compromise. Flaws include use-after-free, heap buffer overflow, integer overflow, object corruption, out-of-bounds read, and inappropriate implementation issues across CSS, GPU, Codecs, ANGLE, WebUSB, Web MIDI, V8, WebCodecs, Dawn, WebGL, PDF, WebView, Navigation, and Compositing. Google is aware that an exploit for CVE-2026-5281 exists in the wild.

Municipal Impact

MS-ISAC rates the risk as High for large and medium government entities and Medium for small government entities; municipal agencies should update Chrome immediately given the active exploit.

SMB Impact

MS-ISAC rates the risk as High for large and medium business entities, Medium for small business entities, and Low for home users.

Recommended Actions

1. Apply appropriate updates provided by Google to vulnerable systems immediately after appropriate testing.
2. Ensure use of only fully supported browsers and email clients.
3. Apply the principle of least privilege to all systems and services.

Grey Matter Analysis