Exploitation observed; activity peaked at 145 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-03-10. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
DECLINING
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 4 products
| Date | Total | Labels |
|---|
| 2026-02-13 | 5 | Active Exploitation1Disclosure3General1 |
| 2026-02-14 | 10 | Disclosure2General1Patch7 |
| 2026-02-15 | 8 | Active Exploitation5General1Patch2 |
| 2026-02-16 | 145 | Active Exploitation86Disclosure7Patch51PoC1 |
| 2026-02-17 | 79 | Active Exploitation48Disclosure5General4Patch22 |
| 2026-02-18 | 59 | Active Exploitation28Disclosure3General4Patch22PoC2 |
| 2026-02-19 | 45 | Active Exploitation22Disclosure4General8Patch9PoC2 |
| 2026-02-20 | 24 | Active Exploitation11Disclosure3General4Patch5PoC1 |
| 2026-02-22 | 10 | Active Exploitation3Disclosure1General3Patch2PoC1 |
| 2026-02-23 | 6 | Disclosure1General3Patch2 |
| 2026-02-24 | 10 | Active Exploitation7Disclosure1General2 |
| 2026-02-25 | 11 | Active Exploitation3Disclosure2General3Patch2PoC1 |
| 2026-02-26 | 3 | Disclosure1General2 |
| 2026-02-27 | 6 | Active Exploitation5PoC1 |
| 2026-02-28 | 1 | Disclosure1 |
| 2026-03-02 | 2 | Patch1PoC1 |
| 2026-03-03 | 3 | Active Exploitation2General1 |
| 2026-03-05 | 1 | Patch1 |
| 2026-03-10 | 6 | Active Exploitation6 |
| 2026-03-11 | 1 | Active Exploitation1 |
| 2026-03-14 | 1 | Disclosure1 |
| 2026-03-16 | 3 | Active Exploitation3 |
| 2026-03-22 | 1 | Patch1 |
| 2026-03-23 | 2 | Active Exploitation1General1 |
| 2026-03-29 | 1 | Active Exploitation1 |
| 2026-03-30 | 1 | General1 |
| 2026-04-01 | 2 | Active Exploitation1Patch1 |
| 2026-04-05 | 1 | Patch1 |
| 2026-04-07 | 1 | General1 |
| 2026-04-11 | 1 | Active Exploitation1 |
| 2026-04-13 | 1 | Disclosure1 |
| 2026-04-17 | 1 | Active Exploitation1 |
| 2026-05-02 | 1 | Disclosure1 |
| 2026-05-06 | 1 | PoC1 |
| 2026-05-08 | 2 | Active Exploitation2 |
| 2026-06-09 | 1 | Active Exploitation1 |
| 2026-07-03 | 1 | Patch1 |
| 2026-07-15 | 1 | Active Exploitation1 |
| 2026-09-06 | 1 | Active Exploitation1 |
| 2026-09-09 | 2 | Active Exploitation2 |
⚡️ 0-Day Alert - Google Chrome RCE exploit in the wild CVE-2026-2441: Iterator Invalidation UAF in CSS parsing Patched in Chrome Stable channel 145.0.7632.75/76 for Windows/Mac and 144.0.7559.75 for Linux https://t.co/AfR45zSnRC
Post summary
CVE-2026-2441 is a use‑after‑free RCE in Chrome that is actively exploited in the wild, and Google has issued patch versions for affected browsers.
🚨 Chrome 0-Day Vulnerability Actively Exploited by Attackers in the Wild Source: https://cybersecuritynews.com/chrome-0-day-vulnerability-exploited-wild-2/ Google has urgently patched a high-severity zero-day vulnerability in Chrome, confirming active exploitation in the wild. Tracked as CVE-2026-2441, the flaw is a use-after-free bug in the browser's CSS handling. Chrome versions prior to the patches remain exposed to remote code execution attacks, where attackers could leverage the memory corruption to execute arbitrary code via malicious web content. Users should apply updates via Chrome's built-in updater or enterprise management tools. #cybersecuritynews
Post summary
A high‑severity zero‑day CVE-2026-2441 in Chrome has been actively exploited via a use‑after‑free bug in CSS handling, prompting an urgent patch from Google and urging users to update immediately.
🚨 Google patched Chrome zero-day CVE-2026-2441, a CVSS 8.8 bug already exploited in attacks. The CSS use-after-free flaw allows sandboxed remote code execution via malicious pages. 🔗 Read → https://thehackernews.com/2026/02/new-chrome-zero-day-cve-2026-2441-under.html First active Chrome zero-day fixed this year. Update now.
Post summary
CVE‑2026‑2441 is a use‑after‑free RCE in Chrome that has already been exploited in the wild; Google has since patched the vulnerability and urges users to update.
The first Chrome zero-day of 2026 just dropped — and it's already being exploited in the wild. CVE-2026-2441: use-after-free in Chrome's CSS engine (CVSS 8.8). Affects every Chromium browser — Edge, Brave, Opera, Arc. Don't wait for auto-update. Patch now. https://donthackonme.substack.com/p/first-chrome-zero-day-of-2026-is
Post summary
The post announces CVE-2026-2441, a use-after-free bug in Chrome's CSS engine, stating it is already being exploited in the wild and urges immediate patching.
Chrome 윈/맥 버전의 CSS 제로데이 취약점 업데이트 배포 - Google이 크롬 업데이트를 릴리즈, CVE-2026-2441 CSS 관련 제로데이 취약점 포함 - 구글은 이 취약점이 실제 공격에 악용되고 있음을 확인했으며, 사용자들은 즉시 최신 버전으로 업데이트 해야 함 https://news.hada.io/topic?id=26823
Post summary
Google has released a Chrome update for CVE‑2026‑2441, a CSS zero‑day that is actively exploited; users are urged to upgrade immediately.
CVE-2026-2441 PoC Chrome CSSFontFeatureValuesMap Use-After-Free https://github.com/huseyinstif/CVE-2026-2441-PoC
Post summary
A proof of concept for CVE-2026-2441, a Chrome use‑after‑free vulnerability, is available on GitHub, but no exploitation evidence or patch information is provided.
【緊急】Chrome 145にゼロデイ脆弱性(CVE-2026-2441)発覚！Use-after-freeの仕組みを技術的に解説する https://qiita.com/harupython/items/fc4342e1fdc0d13564df #Qiita @PythonHaruより
Post summary
An urgent zero‑day vulnerability (CVE‑2026‑2441) affecting Chrome 145 has been discovered, with a technical explanation of the use‑after‑free flaw provided in a Qiita article.
Kto ma Chrome, niechaj łata. ASAP. Załatano właśnie podatność wykorzystywaną w realnych atakach. CVE-2026-2441.
Post summary
CVE-2026-2441 is actively exploited in real attacks; Chrome users are urged to patch immediately.
(CVE-2026-2441)[483569511][CSS]Iteration of the CSSFontFeatureValuesMap -> ... -> UAF, exploited ITW https://chromium.googlesource.com/chromium/src/+/e045399a1ecb7ee16e1a7bcbcd8ea59d283dfb07 https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html https://issues.chromium.org/issues/483936078 https://drafts.csswg.org/css-fonts-4/#om-fontfeaturevalues PoC: https://chromium.googlesource.com/chromium/src/+/63f3cb4864c64c677cd60c76c8cb49d37d08319c/third_party/blink/web_tests/external/wpt/css/css-fonts/font_feature_values_map_iteration.html Reported by Shaheen Fazim(@shaheenfazim) https://t.co/1kQxdMsbnL
Post summary
CVE‑2026‑2441 is a use‑after‑free in Chrome’s CSSFontFeatureValuesMap that has been exploited in the wild, with a PoC and a patch already released.
‼️Atklāta augsta riska nulles dienas ievainojamība Google Chrome un citās uz Chromium bāzētās tīmekļa pārlūkprogrammās (CVE-2026-2441). Ievainojamība jau tiek izmantota reālos uzbrukumos. Vairāk: https://cert.lv/lv/2026/02/nulles-dienas-ievainojamiba-chromium-programmatura https://t.co/4eJy0SPWQ1
Post summary
A newly discovered zero‑day vulnerability (CVE‑2026‑2441) in Chromium‑based browsers is already being exploited in the wild, as reported by a CERT advisory.
#maybe CVE-2026-2441 PoC Chrome CSSFontFeatureValuesMap Use-After-Free https://github.com/huseyinstif/CVE-2026-2441-PoC https://t.co/jaEfvFidQy
Post summary
A GitHub-based PoC demonstrates a use‑after‑free in Chrome’s CSSFontFeatureValuesMap, but no active exploitation or patches are reported.
Google patches critical zero-day CVE-2026-2441. Attackers are exploiting this CSS use-after-free flaw in the wild. Update to Chrome 145 immediately. #Chrome #ZeroDay #CVE20262441 #CyberSecurity #InfoSec #PatchNow #BrowserSecurity https://securityonline.info/critical-alert-chrome-zero-day-cve-2026-2441-exploited-in-the-wild/
Post summary
CVE-2026-2441, a CSS use‑after‑free flaw in Chrome, is being actively exploited; Google has released a patch and urges users to update to Chrome 145.
Google, Chrome tarayıcısında kritik bir güvenlik açığı tespit edildiğini duyurdu. 📌 11 Şubat’ta belirlenen ve “CVE-2026-2441” koduyla anılan açık, bilgisayar korsanlarının rastgele kod çalıştırmasına olanak tanıyordu. Şirket, sorunu gidermek için acil bir güncelleme yayımladı. 📌 Kullanıcıların Windows ve Mac’te 145.0.7632.75/76, Linux’ta ise 144.0.7559.75 sürümüne yükseltme yapması gerekiyor. 📌 Chrome’u güncellemek için: Ayarlar > Chrome hakkında bölümüne girin, güncellemenin otomatik olarak yüklenmesini bekleyin ve tarayıcıyı yeniden başlatın.
Post summary
Google has identified a critical Chrome vulnerability (CVE‑2026‑2441) that permits arbitrary code execution and has released an urgent update; users are advised to upgrade to the specified versions.
@_nat サンドボックス内でのコード実行の脆弱性ですので、この脆弱性単体での影響は限定的かと思います。 https://nvd.nist.gov/vuln/detail/CVE-2026-2441 https://x.com/autumn_good_35/status/2023653146338496944
Post summary
The tweet briefly notes a sandbox code‑execution vulnerability (CVE‑2026‑2441) and links to the NVD entry, but it provides no PoC, exploit, patch, or active exploitation details.
Patch for CVE-2026-2441 https://github.com/chromium/chromium/commit/e045399a1ecb7ee16e1a7bcbcd8ea59d283dfb07
Post summary
A patch commit for CVE‑2026‑2441 is referenced, indicating remediation is available.
GitHub - huseyinstif/CVE-2026-2441-PoC https://github.com/huseyinstif/CVE-2026-2441-PoC
Post summary
A GitHub repository containing a Proof of Concept for CVE-2026-2441 has been shared, indicating potential exploitation but lacking active exploitation evidence, patch details, or technical specifics.
(CVE-2026-2441)[483569511][CSS]@font-feature-values -> CSSOM CSSFontFeatureValuesRule.styleset (maplike) -> map.entries() caches FontFeatureAliases HashMap iterator -> map.delete()/map.set() mutates+rehashes backing map -> stale iterator deref in FetchNextItem() -> UAF -> ...
Post summary
The snippet details technical aspects of CVE-2026-2441, a use‑after‑free in the CSS engine, but does not mention a PoC, exploit, active attacks, or a patch.
CVE-2026-2441 — Chrome CSSFontFeatureValuesMap Use-After-Free https://github.com/huseyinstif/CVE-2026-2441-PoC
Post summary
The snippet announces CVE-2026-2441, a use‑after‑free vulnerability in Chrome’s CSSFontFeatureValuesMap, and directs readers to a GitHub repository containing a PoC that demonstrates the flaw.
New Chrome Zero-Day (CVE-2026-2441) Under Active Attack — Patch Released https://thehackernews.com/2026/02/new-chrome-zero-day-cve-2026-2441-under.html
Post summary
CVE-2026-2441 is a zero‑day vulnerability in Chrome that is actively being exploited, and a patch has been released to mitigate the issue.
GitHub - D3b0j33t/CVE-2026-2441-PoC - https://github.com/D3b0j33t/CVE-2026-2441-PoC?tab=readme-ov-file
Post summary
A GitHub repository provides a proof‑of‑concept for CVE‑2026‑2441, indicating that exploit code is available but no evidence of active exploitation or patch information is present.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | apple | macos | - | - | - |
| App | chrome | - | - | - | |
| OS | linux | linux_kernel | - | - | - |
| OS | microsoft | windows | - | - | - |