Vulnerability intelligence

CVE-2026-2441

Google Chromium CSS Use-After-Free Vulnerability

Google Chromium

Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVSS Score

—

Unrated

EPSS — Exploit Probability

22%

Riskier than 97% of all CVEs · checked 2026-09-04

Exploitation

Confirmed in the wild

KEV since 2026-02-17

Remediation

Patch available

Federal deadline 2026-03-10

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-03-10.

NVD entry Vendor patch PoC / advisory CISA KEV

13 articles across 6 outlets · first covered Feb 15, 2026 · latest Sep 4, 2026

Coverage timeline

CISA Flags Actively Exploited Chrome Flaw as Sixth 2026 Zero-Day
securityaffairs.com · Sep 4, 2026
Google Patches Actively Exploited Chrome V8 Zero Day
securityaffairs.com · Sep 4, 2026
Google Patches Chrome Zero Day Exploited in V8 Attacks
thehackernews.com · Sep 4, 2026
Google fixed two new actively exploited flaws in the Chrome browser
securityaffairs.com · Mar 13, 2026
Google issues Chrome patch after exploited zero day CVE-2026-2441
databreaches.net · Feb 23, 2026
U.S. CISA adds Google Chromium CSS, Microsoft Windows, TeamT5 ThreatSonar Anti-Ransomware, and Zimbra flaws to its Known Exploited Vulnerabilities catalog
securityaffairs.com · Feb 18, 2026
CISA Flags Four Security Flaws Under Active Exploitation in Latest KEV Update
thehackernews.com · Feb 18, 2026
Weekly Recap: Outlook Add-Ins Hijack, 0-Day Patches, Wormable Botnet & AI Malware
thehackernews.com · Feb 16, 2026
CVE-2026-2441: Chrome Zero-Day Enables In-Sandbox Code Execution
socradar.io · Feb 16, 2026
Google fixes first actively exploited Chrome zero-day of 2026
securityaffairs.com · Feb 16, 2026
Google Patches First Actively Exploited Chrome Zero-Day of 2026
www.securityweek.com · Feb 16, 2026
New Chrome Zero-Day (CVE-2026-2441) Under Active Attack — Patch Released
thehackernews.com · Feb 16, 2026
Critical Alert: Chrome Zero-Day (CVE-2026-2441) Exploited in the Wild
securityonline.info · Feb 15, 2026

Related CVEs — Google

CVE-2026-85046KEV CVE-2026-5281KEV CVE-2026-11645KEV CVE-2026-3909KEV CVE-2026-3910KEV CVE-2026-84353 CVE-2026-84352 CVE-2026-79282