• Posted by: Eng. Donya Bino
• February 16, 2026

Chrome Fixes Exploited Zero-Day in CSS (CVE-2026-2441)

There is an urgent update from Google for their browser due to a zero-day vulnerability that is currently being used by attackers in the wild.

CVE-2026-2441 (CVSS 8.8 - High severity) refers to the vulnerability. The type of vulnerability is a use-after-free in the browser’s CSS engine (i.e., a memory access error). Security researcher Shaheen Fazim discovered and reported it to Google on February 11, 2026. Simply put, a remote attacker can create a malicious HTML page that exploits this issue and ultimately results in the execution of arbitrary code; however, it is contained within Chrome's sandbox.

Google's advisory is unusually candid: "An exploit for CVE-2026-2441 exists in the wild." They didn't share specifics about the attacks (who's behind them, who the targets are, or how widespread the exploitation is), but the language strongly suggests targeted activity , likely espionage, spyware, or financially motivated campaigns rather than mass malware.

This marks the first actively exploited zero-day patched in Chrome in 2026. In 2025, Google fixed eight such flaws that were either exploited in the wild or had credible proof-of-concept code.

The timing is notable: just one week after Apple patched CVE-2026-20700 (a dyld memory corruption zero-day) that was used in "extremely sophisticated" attacks against specific individuals on older iOS versions. Browser and OS zero-days remain prime targets for advanced threat actors because they reach billions of devices and often require no user interaction beyond visiting a malicious site.

What Must Be Done NOW
1. Chrome for Windows and macOS users: Update your version to 145.0.7632.75 (or 145.0.7632.76, depending on the build).
2. Chrome for Linux users: Update to version 144.0.7559.75.
3. Other Chromium-based browsers (Edge, Brave, Opera, Vivaldi, etc.): Install their respective updates immediately after release; most vendors will implement their patches in a timeframe between several hours and several days after Google's patch release.

To update manually: Chrome menu → Help → About Google Chrome → Let it check, download, and relaunch.

Quick Context on the Bigger Picture
Browser zero-days are especially attractive because:
1. Chrome rules desktop and mobile internet access
2. CSS and DOM render engines are complicated and change often
3. Exploiting many vulnerabilities requires chaining the exploit with other bugs (e.g., a sandbox escape or privilege escalation)
4. A wide variety of targets exist for exploitation - from journalists and dissidents (who may be targeted by spyware) to companies trying to conduct corporate espionage to individuals attempting financial fraud.

If you belong to a higher-risk group: journalist, activist, executive, government employee/agent, or member of the military/defense industry, you should enable Enhanced Safe Browsing, keep your automatic updates turned on, and create a separate secure profile for work that involves confidential information.
For everyone else: just update Chrome, it’s one of the fastest ways to close a live attack path.

Source: The Hacker News