---
title: NR26-04: Google Chrome – Critical Use-After-Free (CVE-2026-5281)
source: https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr26-04
---

**Vulnerability Identifier:** NR26-04

**Priority:** Critical

## Summary

We are notifying customers of a critical security vulnerability (CVE-2026-5281) identified in **Google Chrome**. This issue originates from a third-party component and is not a flaw in the New Relic product itself.

Within the New Relic ecosystem, the potential impact is limited to **Synthetic Monitoring**. Specifically, exposure may occur only if a synthetic monitor using a vulnerable browser instance navigates to a malicious or compromised webpage.

## Action required

To use the latest Chrome version (`146.0.7680.177`) with **Synthetics Node Browser Runtimes**:

For Public Monitors: Select **Latest** from the runtime version dropdown in your monitor settings for Scripted Browser monitors

![Image of Chrome latest runtime version selection in monitor settings](https://docs.newrelic.com/images/chrome-latest.webp "Chrome latest runtime version selection in monitor settings")

For Private Monitors: Use DockerHub Image with rc1.14 tag ([link](https://hub.docker.com/layers/newrelic/synthetics-node-browser-runtime/rc1.14/images/sha256-b2a79a37ab4b28f5b59a90b4ea69cc498d5aaed8c205c67881a1ce6222727e1c)) to get the latest `synthetics-node-browser-runtime` image which uses chrome `146.0.7680.177` version. You can use the `DESIRED_RUNTIMES` variable to configure the runtime version while starting the Private Location.

## Frequently Asked Questions

1.  **How can I tell if my scripted monitors are impacted?**

    Customers can get a list of monitors that are not on the latest Chrome version by using this account-specific NRQL query:

    `select uniques(monitorId) from SyntheticCheck where type = 'SCRIPT_BROWSER' and browserVersion !='146.0.7680.177-1' and browser!='FIREFOX' since 1 week ago`

2.  **If I am running on Private Locations do I need to update my Synthetics Job Managers along with Node Browser Runtimes?**

    We generally recommend customers use the latest SJM release ([release-513](https://hub.docker.com/layers/newrelic/synthetics-job-manager/release-513/images/sha256-c2172ca051ca3b830e31bdb78939323527b14b5360520dc76fec459d243855d9) or later).

3.  **How do I update the Simple Browser and Step Monitors?**

    For Public Location: No separate action is required from customers as we are upgrading to **Latest** from our end.

    For Private Locations: Use DockerHub Image with rc1.14 tag ([link](https://hub.docker.com/layers/newrelic/synthetics-node-browser-runtime/rc1.14/images/sha256-b2a79a37ab4b28f5b59a90b4ea69cc498d5aaed8c205c67881a1ce6222727e1c)) to get the latest `synthetics-node-browser-runtime` image which uses chrome `146.0.7680.177` version. You can use the `DESIRED_RUNTIMES` variable to configure the runtime version while starting the Private Location.

4.  **What should I do if my Scripted Browser monitor is failing after upgrading to the latest version of Chrome?**

    If you encounter issues validating your scripts on the latest Chrome 146+ runtime, please refer to following documents for reference:

    -   [Transition Guide for Scripted Browser Monitors](https://docs.newrelic.com/docs/synthetics/synthetic-monitoring/scripting-monitors/synthetics-scripted-browser-monitors-to-chrome-latest/)
    -   [Troubleshooting Scripted Browser Errors](https://docs.newrelic.com/docs/synthetics/synthetic-monitoring/troubleshooting/simple-scripted-or-scripted-api-non-ping-errors/)
    -   [Troubleshooting Runtime Upgrade Errors](https://docs.newrelic.com/docs/synthetics/synthetic-monitoring/troubleshooting/runtime-upgrade-troubleshooting/)
    -   [Troubleshooting Private Locations](https://docs.newrelic.com/docs/synthetics/synthetic-monitoring/private-locations/troubleshoot-private-locations/)

    If additional assistance is needed, open a case with our Support team through the help section in the New Relic platform.

## Technical Vulnerability Information

[CVE-2026-5281](https://nvd.nist.gov/vuln/detail/CVE-2026-5281)

## Publication History

April 04, 2026 - NR26-04 Published