New Chrome Zero-Day (CVE-2026-2441) Under Active Attack — Patch Released
Summary: Google released Chrome security updates on Friday for CVE-2026-2441, a high-severity (CVSS 8.8) use-after-free bug in CSS that allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Researcher Shaheen Fazim reported the flaw on February 11, 2026, and Google acknowledged an exploit exists in the wild without disclosing who is exploiting it or who was targeted, making it the first actively exploited Chrome zero-day patched in 2026 after eight such flaws last year.
Why it matters: A use-after-free in CSS that reaches arbitrary code execution inside the sandbox is reachable through a crafted HTML page, so the exposure is anyone running a Chrome build below 145.0.7632.75 - and Google has said nothing about who is behind the exploit or whom it targets.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-20700CVE-2026-2441
- Related
- CVE-2026-2441: Google Chromium CSS Use-After-Free Vulnerability Known Exploited Vulnerabilities · Feb 17, 2026