Vulnerability intelligence

CVE-2026-2441

Google Chromium CSS Use-After-Free Vulnerability

Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS Score

—

Unrated

EPSS — Exploit Probability

55%

Riskier than 99% of all CVEs · checked 2026-10-21

Exploitation

Confirmed in the wild

KEV since 2026-02-17

Remediation

Patch available

Federal deadline 2026-03-10

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-03-10.

NVD entry Vendor patch PoC / advisory CISA KEV

15 articles across 6 outlets · first covered Feb 15, 2026 · latest Sep 9, 2026

Coverage timeline

Google Patches Chrome’s Seventh Zero Day of 2026 Under Attack
securityaffairs.com · Sep 9, 2026
Chrome Patches Exploited V8 Zero Day Allowing Code Execution
thehackernews.com · Sep 9, 2026
CISA Flags Actively Exploited Chrome Flaw as Sixth 2026 Zero-Day
securityaffairs.com · Sep 4, 2026
Google Patches Actively Exploited Chrome V8 Zero Day
securityaffairs.com · Sep 4, 2026
Google Patches Chrome Zero Day Exploited in V8 Attacks
thehackernews.com · Sep 4, 2026
Google fixed two new actively exploited flaws in the Chrome browser
securityaffairs.com · Mar 13, 2026
Google issues Chrome patch after exploited zero day CVE-2026-2441
databreaches.net · Feb 23, 2026
U.S. CISA adds Google Chromium CSS, Microsoft Windows, TeamT5 ThreatSonar Anti-Ransomware, and Zimbra flaws to its Known Exploited Vulnerabilities catalog
securityaffairs.com · Feb 18, 2026
CISA Flags Four Security Flaws Under Active Exploitation in Latest KEV Update
thehackernews.com · Feb 18, 2026
Weekly Recap: Outlook Add-Ins Hijack, 0-Day Patches, Wormable Botnet & AI Malware
thehackernews.com · Feb 16, 2026
CVE-2026-2441: Chrome Zero-Day Enables In-Sandbox Code Execution
socradar.io · Feb 16, 2026
Google fixes first actively exploited Chrome zero-day of 2026
securityaffairs.com · Feb 16, 2026
Google Patches First Actively Exploited Chrome Zero-Day of 2026
www.securityweek.com · Feb 16, 2026
New Chrome Zero-Day (CVE-2026-2441) Under Active Attack — Patch Released
thehackernews.com · Feb 16, 2026
Critical Alert: Chrome Zero-Day (CVE-2026-2441) Exploited in the Wild
securityonline.info · Feb 15, 2026

Related CVEs — Google

CVE-2026-113271 CVE-2026-113303 CVE-2026-0075 CVE-2026-110922 CVE-2026-110913 CVE-2026-110919 CVE-2026-110921 CVE-2026-110915