Google Patches First Chrome Zero-Day of 2026: CVE-2026-2441

Chrome's First 2026 Zero-Day

Google has released an emergency update for Chrome to address CVE-2026-2441, a high-severity use-after-free vulnerability in the browser's CSS handling component. The flaw has been actively exploited in the wild, making it the first Chrome zero-day that Google has patched in 2026.

Security researcher Shaheen Fazim discovered and reported the vulnerability on February 11, 2026. Google acknowledged that "an exploit for CVE-2026-2441 exists in the wild" and released a patch just two days later on February 13.

Vulnerability Details

How the Exploit Works

Use-After-Free in CSS

A use-after-free vulnerability occurs when a program continues to reference memory after it has been freed. In Chrome's CSS engine:

1. The CSS parser allocates memory for a style object
2. Under specific conditions, the object is freed prematurely
3. The freed memory is reallocated for attacker-controlled data
4. Chrome's CSS engine references the now-attacker-controlled memory
5. The attacker achieves arbitrary code execution within Chrome's sandbox

From Sandbox to System

While the initial exploit runs within Chrome's sandbox (a security boundary), it can be chained with:

• Sandbox escape vulnerabilities to break out to the operating system
• Privilege escalation bugs to gain elevated access
• The current six Microsoft zero-days for full Windows system compromise

Patched Versions

How to Update

1. Open Chrome and navigate to chrome://settings/help
2. Chrome will check for updates and download automatically
3. Click Relaunch to apply the update
4. Verify the version number matches the patched version above

Impact Assessment

A successful exploit of CVE-2026-2441 enables:

Chrome Zero-Day Trend

Chrome zero-days continue to be a valuable commodity for both nation-state actors and commercial spyware vendors:

Enterprise Considerations

For IT Administrators

1. Force Chrome updates via Group Policy or enterprise management tools
2. Monitor for outdated Chrome instances — Unpatched browsers are immediate targets
3. Review browser isolation strategies — Consider remote browser isolation for high-risk users
4. Enable Chrome's Enhanced Safe Browsing to get real-time protection against known exploit sites

For Security Teams

1. Hunt for IOCs associated with CVE-2026-2441 exploitation
2. Check proxy/web filter logs for connections to known exploit kit infrastructure
3. Correlate with endpoint detection — Look for post-exploitation behavior following browser process anomalies
4. Update WAF rules if protecting web applications from being weaponized as delivery vectors

Key Takeaways

1. First Chrome zero-day of 2026 — CVE-2026-2441 is a use-after-free in the CSS engine (CVSS 8.8)
2. Actively exploited — Google confirms in-the-wild exploitation
3. Two-day patch turnaround — Disclosed Feb 11, patched Feb 13
4. Update Chrome immediately — Version 145.0.7632.75/76 on Windows/Mac, 144.0.7559.75 on Linux
5. Chainable with other vulnerabilities for full system compromise

Sources

• The Hacker News — New Chrome Zero-Day (CVE-2026-2441) Under Active Attack — Patch Released
• Malwarebytes — Update Chrome Now: Zero-Day Bug Allows Code Execution via Malicious Webpages
• Help Net Security — Google Patches Chrome Vulnerability With In-the-Wild Exploit
• SecurityWeek — Google Patches First Actively Exploited Chrome Zero-Day of 2026