Google fixes first actively exploited Chrome zero-day of 2026

Google patched Chrome zero-day CVE-2026-2441, a high-severity CSS use-after-free flaw actively exploited in the wild.

Google has released urgent security updates to address a high-severity zero-day vulnerability, tracked as CVE-2026-2441, in Chrome that is already being exploited in real-world attacks. The flaw is a use-after-free bug in the browser’s CSS component.

This is the first actively exploited Chrome zero-day fixed in 2026, after eight similar flaws were patched in 2025.

“Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.” reads the description of the vulnerability provided by NIST’s National Vulnerability Database (NVD).

An attacker could exploit the flaw to compromise affected systems. The issue was discovered and responsibly reported by security researcher Shaheen Fazim on February 11, 2026.

“CVE-2026-2441: Use after free in CSS. Reported by Shaheen Fazim on 2026-02-11.” reads the Google’s advisory. “Google is aware that an exploit for CVE-2026-2441 exists in the wild.”

Google has confirmed that an exploit for CVE-2026-2441 exists in the wild, but has not shared details about how it is being used or which threat actor is behind the exploitation of the flaw.

Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should also install updates once available. Chrome’s Stable channel has been updated to versions 145.0.7632.75/76 for Windows and Mac, and 144.0.7559.75 for Linux, with the rollout happening over the coming days and weeks.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Chrome zero-day CVE-2026-2441)