Google patched Chrome zero-day CVE-2026-2441, a high-severity CSS use-after-free flaw actively exploited in the wild.
Google has released urgent security updates to address a high-severity zero-day vulnerability, tracked as CVE-2026-2441, in Chrome that is already being exploited in real-world attacks. The flaw is a use-after-free bug in the browser’s CSS component.
This is the first actively exploited Chrome zero-day fixed in 2026, after eight similar flaws were patched in 2025.
“Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.” reads the description of the vulnerability provided by NIST’s National Vulnerability Database (NVD).
An attacker could exploit the flaw to compromise affected systems. The issue was discovered and responsibly reported by security researcher Shaheen Fazim on February 11, 2026.
EXPLORE MORE
Poorly crafted phishing campaign leverages bogus security incident report
Attackers used a fake PDF incident report hosted on AWS to scare…
Iran's Ghalibaf Declares Persian Gulf Oil Flows For 'All Or None'
Via The Cradle Iranian Parliament Speaker Mohammad Bagher Ghalibaf declared on 28…
How June Lapine Dismantled Hasan Piker’s Image and Forced a Wardrobe Transformation
June Lapine, known widely online as Shoe0468 (or Shoe013), has long occupied…
ApolloMD data breach impacts 626,540 people
A May 2025 cyberattack on ApolloMD exposed the personal data of over…
Dutch agencies hit by Ivanti EPMM exploit exposing employee contact data
Dutch agencies confirmed attacks exploiting Ivanti EPMM flaws that exposed employee contact…
Canada Is Poaching America’s Top Scientists
Canada is taking advantage of growing uncertainty within the US academic system…
“CVE-2026-2441: Use after free in CSS. Reported by Shaheen Fazim on 2026-02-11.” reads the Google’s advisory. “Google is aware that an exploit for CVE-2026-2441 exists in the wild.”
Google has confirmed that an exploit for CVE-2026-2441 exists in the wild, but has not shared details about how it is being used or which threat actor is behind the exploitation of the flaw.
Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should also install updates once available. Chrome’s Stable channel has been updated to versions 145.0.7632.75/76 for Windows and Mac, and 144.0.7559.75 for Linux, with the rollout happening over the coming days and weeks.
