CVE-2026-2441

8.8

HIGH CVSS 3.1

Google Chromium CSS Use-After-Free Vulnerability - [Actively Exploited]

Description

Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

INFO

Published Date :

Feb. 13, 2026, 7:17 p.m.

Last Modified :

Feb. 23, 2026, 1:24 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Mar 10, 2026 | 3 days left

Alert Date: Feb 17, 2026 | 17 days ago

Description :

Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known Ransomware Campaign Use:

Unknown

Notes :

https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-2441

Affected Products

The following products are affected by CVE-2026-2441 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Microsoft	windows
2	Microsoft	edge_chromium
1	Linux	linux_kernel
1	Google	chrome
1	Apple	macos

: Total Affected Vendor : 4 | Products : 5

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				134c704f-9b21-4f2e-91b3-4a467353bcc0
	CVSS 3.1	HIGH				[email protected]

Solution

Update Google Chrome to the latest version to fix a memory corruption vulnerability.

Update Google Chrome to version 145.0.7632.75 or later.
Ensure the browser is automatically updated.

Public PoC/Exploit Available at Github

CVE-2026-2441 has a 28 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-2441.

URL	Resource
https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html	Release Notes
https://issues.chromium.org/issues/483569511	Issue Tracking Permissions Required
https://github.com/huseyinstif/CVE-2026-2441-PoC/blob/main/poc.html	Exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-2441	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-2441 is associated with the following CWEs:

CWE-416: Use After Free

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-2441 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

fartlover37/CVE-2026-2441-PoC

Demonstrate a proof-of-concept exploit for CVE-2026-2441, a high-risk Chrome use-after-free vulnerability in the Blink CSS engine.

agent agents chinese gluon hacktoberfest notebook obfuscation person-reid poc rag semantic-segmentation testnet testnet-faucet vulnerability web3 zdi

Updated: 1 day, 3 hours ago

0 stars 0 fork 0 watcher

Born at : March 3, 2026, 2:19 p.m. This repo has been linked 1 different CVEs too.

NAH030/Vulnerability-STIG-Remediations-Using-Powershell

None

Updated: 3 days, 22 hours ago

0 stars 0 fork 0 watcher

Born at : March 1, 2026, 11:37 p.m. This repo has been linked 7 different CVEs too.

D3b0j33t/CVE-2026-2441-PoC

None

HTML

Updated: 4 days, 8 hours ago

0 stars 0 fork 0 watcher

Born at : March 1, 2026, 6:34 p.m. This repo has been linked 1 different CVEs too.

NetVanguard-cmd/CVE-2026-2441

None

Updated: 1 week, 2 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 24, 2026, 5:25 p.m. This repo has been linked 1 different CVEs too.

atiilla/CVE-2026-2441_PoC

None

HTML

Updated: 1 week, 3 days ago

0 stars 1 fork 1 watcher

Born at : Feb. 23, 2026, 8:43 a.m. This repo has been linked 1 different CVEs too.

washingtonmaister/CVE-2026-2441

None

Updated: 1 week, 6 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 20, 2026, 10:50 p.m. This repo has been linked 1 different CVEs too.

kapetanios55/SentinelCBContent

None

Shell Python

Updated: 1 week ago

0 stars 0 fork 0 watcher

Born at : Feb. 20, 2026, 10:40 p.m. This repo has been linked 23 different CVEs too.

RootAid/CVE-2026-2441

None

Updated: 1 week, 6 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 20, 2026, 3:52 p.m. This repo has been linked 1 different CVEs too.

theemperorspath/CVE-2026-2441-PoC

None

HTML

Updated: 2 weeks ago

0 stars 0 fork 0 watcher

Born at : Feb. 19, 2026, 11:48 p.m. This repo has been linked 1 different CVEs too.

jermaine22sei/CVE-2026-2441

None

Updated: 2 weeks, 1 day ago

0 stars 0 fork 0 watcher

Born at : Feb. 18, 2026, 9:27 p.m. This repo has been linked 1 different CVEs too.

huseyinstif/CVE-2026-2441-PoC

None

HTML

Updated: 1 week, 2 days ago

80 stars 10 fork 10 watcher

Born at : Feb. 18, 2026, 11:46 a.m. This repo has been linked 1 different CVEs too.

b1gchoi/CVE-2026-2441_POC

None

HTML

Updated: 2 weeks ago

4 stars 0 fork 0 watcher

Born at : Feb. 16, 2026, 9:46 a.m. This repo has been linked 1 different CVEs too.

timosarkar/0clickheaven

the zero-click exploit heaven

Updated: 2 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 14, 2026, 1:49 p.m. This repo has been linked 2 different CVEs too.

L5T2Y0/daily-hn-archives

每天自动归档 Hacker News 热门文章

Python

Updated: 2 weeks, 1 day ago

1 stars 0 fork 0 watcher

Born at : Feb. 14, 2026, 1:06 p.m. This repo has been linked 1 different CVEs too.

huc-b/AutoProfile

展示自我

Python

Updated: 2 weeks, 1 day ago

0 stars 0 fork 0 watcher

Born at : Nov. 21, 2025, 7:25 a.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-2441 vulnerability anywhere in the article.

Daily CyberSecurity

Update Chrome Now: Google Patches 3 Critical Flaws and 7 High-Risk Vulnerabilities

Google has released an urgent update for the Chrome Stable channel, addressing 10 security vulnerabilities, including three rated as “Critical” and seven rated as “High” severity. The update is rollin ...

Published Date: Mar 05, 2026 (1 day, 1 hour ago)

Daily CyberSecurity

Critical 10.0 CVSS Flaw in Cisco Secure FMC Hands Hackers Root Access to Enterprise Firewalls

Cybersecurity researchers have identified a critical vulnerability in Cisco Secure Firewall Management Center (FMC) Software, the administrative “nerve center” used to manage unified security policies ...

Published Date: Mar 05, 2026 (1 day, 1 hour ago)

Daily CyberSecurity

CISA Adds Qualcomm and VMware Flaws to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog, adding two high-stakes flaws that are reportedly being weaponized in the wil ...

Published Date: Mar 04, 2026 (2 days ago)

Daily CyberSecurity

WordPress Security Alert: Critical Privilege Escalation Flaw in Popular Membership Plugin

A massive security hole has been discovered in the User Registration & Membership plugin for WordPress, a popular tool used by over 60,000 websites to manage tiered subscription plans and custom login ...

Published Date: Mar 04, 2026 (2 days, 2 hours ago)

Daily CyberSecurity

Critical RCE Flaw in Qwik Framework Allows Server Takeover via Single Request

Security researchers have identified a critical vulnerability in Qwik, the popular web framework known for its “instant-on” performance and resumability. The flaw, tracked as CVE-2026-27971, carries a ...

Published Date: Mar 04, 2026 (2 days, 2 hours ago)

Daily CyberSecurity

Cyber Escalation: Multi-Vector Attacks Surge Following “Operation Epic Fury”

In the wake of the massive joint offensive launched by the United States and Israel on February 28, the digital battlefield has seen a sharp escalation in activity. A new report from Unit 42 reveals t ...

Published Date: Mar 03, 2026 (2 days, 18 hours ago)

Daily CyberSecurity

Security Alert: “Hackerbot-Claw” Autonomous Campaign Exploits GitHub Actions

Christopher Robinson, Chief Technology Officer and Chief Security Architect at the Open Source Security Foundation (OpenSSF), has issued a warning regarding an active, automated attack campaign dubbed ...

Published Date: Mar 03, 2026 (2 days, 22 hours ago)

Daily CyberSecurity

Security Alert: Android March 2026 Update Targets Actively Exploited Zero-Day

Google has released its most substantial security update in years, addressing a total of 129 vulnerabilities in the March 2026 Android Security Bulletin. The massive patch arrives amid warnings that a ...

Published Date: Mar 03, 2026 (3 days ago)

Daily CyberSecurity

CVE-2026-2256: Unpatched Flaw in MS-Agent Lets Hackers Hijack AI Assistants

We are officially entering the era of the “autonomous agent”—smart AI programs that don’t just chat with you, but actually do things on your computer, like organizing files, searching the web, or runn ...

Published Date: Mar 03, 2026 (3 days ago)

Daily CyberSecurity

Beyond the Router: How the Zerobotv9 Botnet is Hijacking Enterprise Automation

According to a recent investigation by the Akamai Security Intelligence and Response Team (SIRT), a notorious malware family known as Zerobot has re-emerged with new tricks. This latest iteration, dub ...

Published Date: Mar 03, 2026 (3 days, 2 hours ago)

Daily CyberSecurity

High-Severity XSS Flaw in Angular i18n Turns Language Files into Backdoors

A newly security flaw was found in the widely used Angular web building platform. Identified as CVE-2026-27970 (and rated as a high-severity 7.6), this vulnerability shows how hackers could easily hid ...

Published Date: Mar 03, 2026 (3 days, 2 hours ago)

Daily CyberSecurity

From Chat App to Dark Web: How Telegram Became the New Hub for Cybercrime

For millions of people around the world, Telegram is a secure and convenient way to chat with friends, follow news channels, or join community groups. However, beneath the surface of everyday messagin ...

Published Date: Mar 03, 2026 (3 days, 2 hours ago)

Daily CyberSecurity

Bridging the Gap: North Korean APT37 Deploys ‘Ruby Jumper’ to Infiltrate Isolated Air-Gapped Networks

In a sophisticated escalation of cyber espionage, the North Korean-linked threat group APT37 (also known as ScarCruft or Ruby Sleet) has been caught deploying a novel toolkit designed to leap over the ...

Published Date: Mar 03, 2026 (3 days, 2 hours ago)

Daily CyberSecurity

Critical Backup Flaws Expose Vitess Environments to Complete Takeover

Vitess is a cloud-native horizontally-scalable distributed database system that is built around MySQL. It allows organizations to achieve unlimited scaling through generalized sharding, and operators ...

Published Date: Mar 02, 2026 (4 days, 1 hour ago)

Daily CyberSecurity

Critical 9.8 Flaw in Langflow’s AI CSV Agent Opens a Direct Path to Root Shell

Artificial intelligence is making it easier than ever to build complex applications, but a newly discovered vulnerability shows that these same tools can inadvertently leave the front door wide open f ...