CVE-2026-5281 Research Toolkit

Chrome WebGPU Use-After-Free (CWE-416)

This toolkit is for security research and defensive verification around CVE-2026-5281. Patched Chrome version: 146.0.7680.178 Potentially vulnerable versions: anything below 146.0.7680.178

Files

• cve_2026_5281_scanner.py
  • Unified scanner for local machine checks, fleet CSV checks, and log triage.
• cve_2026_5281_exploit.py
  • PoC artifact generator (creates files such as HTML/JSON/JS for lab testing).

Requirements

• Windows PowerShell or terminal
• Python 3.8+

Quick Start

From this folder:

cd CVE-2026-5281

How To Run cve_2026_5281_scanner.py

Show help:

python cve_2026_5281_scanner.py --help

1. Check this device (local Chrome)

python cve_2026_5281_scanner.py --local

JSON output version:

python cve_2026_5281_scanner.py --local --json

What you will see:

• VULNERABLE if local Chrome is below 146.0.7680.178
• SAFE if local Chrome is at or above 146.0.7680.178
• UNKNOWN if version cannot be parsed

2. Check a fleet from CSV

Run:

python cve_2026_5281_scanner.py --fleet ".\sample_fleet.csv"

CSV format required:

host,product,version
PC-01,Google Chrome,146.0.7680.165
PC-02,Google Chrome,146.0.7680.200

JSON output version:

python cve_2026_5281_scanner.py --fleet ".\sample_fleet.csv" --json

3. Triage log files for suspicious signatures

Single file:

python cve_2026_5281_scanner.py --triage ".\sample.log"

Folder scan:

python cve_2026_5281_scanner.py --triage "C:\path\to\logs"

How To Run cve_2026_5281_exploit.py

Show help:

python cve_2026_5281_exploit.py --help

Generate all PoC artifacts into a test folder:

python cve_2026_5281_exploit.py --generate-all --output ".\_poc_output"

Generate only one type of artifact:

python cve_2026_5281_exploit.py --html-payload --output ".\_poc_output"
python cve_2026_5281_exploit.py --detection-script --output ".\_poc_output"
python cve_2026_5281_exploit.py --server-config --output ".\_poc_output"
python cve_2026_5281_exploit.py --staged-payload --output ".\_poc_output"

Typical Workflow

1. Run local scanner first:

python cve_2026_5281_scanner.py --local --json

2. If vulnerable, upgrade Chrome to 146.0.7680.178 or newer.

3. Re-run scanner to confirm patched state.

Claim Readiness

Use this section to produce reproducible evidence that your verification is complete and defensible.

1. Generate PoC artifacts and serve locally

python cve_2026_5281_exploit.py --generate-all --output ".\poc_fixed"
python -m http.server 8080 -d ".\poc_fixed"

2. Capture a vulnerable run (below patched threshold)

Run the automated browser test and save structured output:

python cve_2026_5281_automated_test.py --url "http://localhost:8080/exploit.html" --timeout 20 --out-json ".\evidence\vulnerable_run.json"

Also save console output into a text log for the scanner assessment:

python cve_2026_5281_automated_test.py --url "http://localhost:8080/exploit.html" --timeout 20 *> ".\evidence\vulnerable_run.log"

3. Capture a patched run (at or above 146.0.7680.178)

After upgrading browser, repeat and save outputs:

python cve_2026_5281_automated_test.py --url "http://localhost:8080/exploit.html" --timeout 20 --out-json ".\evidence\patched_run.json"
python cve_2026_5281_automated_test.py --url "http://localhost:8080/exploit.html" --timeout 20 *> ".\evidence\patched_run.log"

4. Run formal claim assessment

python cve_2026_5281_scanner.py --assess-claim --vuln-log ".\evidence\vulnerable_run.log" --patched-log ".\evidence\patched_run.log" --vuln-version "146.0.7680.165" --patched-version "146.0.7680.178" --json

Expected assessment behavior:

• READY: vulnerable run has fatal GPU signals, patched run does not, and versions are on correct sides of the fixed threshold.
• PARTIAL: some required checks pass but evidence is incomplete.
• INSUFFICIENT: evidence does not support a strong claim.

5. Evidence checklist

• Local version audit output from --local --json
• Vulnerable run JSON (.\evidence\vulnerable_run.json)
• Patched run JSON (.\evidence\patched_run.json)
• Vulnerable and patched run logs (.log files)
• Claim assessment JSON output

Legal Notice

Use only on systems and environments you own or are explicitly authorized to test.