CVE-2026-2441
Google Chromium CSS Use-After-Free Vulnerability
Description
CVE-2026-2441 is a high-severity use-after-free vulnerability in the CSS processing engine of Google Chrome prior to version 145.0.7632.75. With a CVSS v3.1 base score of 8.8, the flaw enables a remote attacker to execute arbitrary code inside the browser sandbox by enticing a victim to visit a specially crafted HTML page. The vulnerability arises when Chrome's rendering engine incorrectly frees a CSS-related object and later accesses the freed memory, creating a window for exploitation. CISA has added CVE-2026-2441 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 10, 2026, and the ransomware association is currently classified as unknown. The EPSS score stands at 0.35% at the 56th percentile, reflecting moderate but meaningful exploitation probability. Because Chrome is one of the most widely deployed browsers worldwide, the potential blast radius of this vulnerability is extremely large, affecting billions of desktop and mobile users across all major operating systems.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 145.0.7632.75; < 145.0.7632.76 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html(Release Notes)
- https://issues.chromium.org/issues/483569511(Issue Tracking, Permissions Required)
- https://github.com/huseyinstif/CVE-2026-2441-PoC/blob/main/poc.html(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-2441(US Government Resource)
Weakness Type
CWE-416: Use After Free
CVE-2026-2441 is classified under CWE-416 (Use After Free). This weakness occurs when a program continues to reference memory after it has been released back to the memory allocator. In Chrome's CSS engine, the vulnerability manifests when a CSS-related object is freed during page layout or style recalculation, but a dangling pointer to that object is subsequently dereferenced during further rendering operations. An attacker can manipulate the timing and sequencing of CSS operations to trigger the free event while ensuring the stale pointer is still reachable, then arrange for attacker-controlled data to occupy the freed memory region. When Chrome follows the dangling pointer, it operates on attacker-controlled data instead of the original object, enabling arbitrary code execution. Use-after-free vulnerabilities have been one of the most prevalent and dangerous bug classes in browser engines, and Chromium has invested significantly in mitigations such as MiraclePtr and memory tagging, though bypasses continue to emerge.
Impact Analysis
The impact of CVE-2026-2441 spans the full CIA triad with high severity across all three dimensions. Confidentiality is severely compromised because successful exploitation grants the attacker code execution within the Chrome renderer sandbox, allowing access to all data within the current browsing context including session cookies, authentication tokens, form data, and any sensitive content displayed in the active tab or accessible through same-origin requests.
Integrity is equally affected, as the attacker can execute arbitrary code that modifies web content, injects malicious scripts, alters form submissions, or manipulates rendered pages to conduct phishing or credential theft. The attacker's code runs with the full privileges of the renderer process, enabling sophisticated man-in-the-browser attacks that are invisible to the user.
Availability faces high impact because the attacker can crash the renderer process at will or consume system resources, disrupting the user's browsing session. While Chrome's multi-process architecture limits the direct impact to the compromised tab, chaining with a sandbox escape could extend the impact to the entire system. The attack vector is network-based (AV:N) with low complexity (AC:L) and requires no privileges (PR:N), though it does require user interaction (UI:R) in the form of visiting or being redirected to a malicious page. The scope remains unchanged (S:U), confining the immediate impact to the renderer sandbox unless combined with additional exploits.
Exploit Maturity
CVE-2026-2441 has confirmed active exploitation, as demonstrated by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of March 10, 2026. A public proof-of-concept exploit is available on GitHub (CVE-2026-2441-PoC), which demonstrates the triggering condition using a crafted HTML page that manipulates CSS operations to induce the use-after-free condition. The EPSS score of 0.35% at the 56th percentile is moderate, but the availability of a public PoC and the browser's ubiquity significantly lower the barrier for widespread exploitation. The Chromium issue tracker entry (483569511) provides additional technical context. Browser use-after-free vulnerabilities in CSS engines are highly sought after by exploit developers and are frequently chained with sandbox escape vulnerabilities to achieve full system compromise, making this vulnerability a high-priority target for both criminal groups and state-sponsored actors.
Remediation
-
Update Google Chrome immediately to version 145.0.7632.75 or later. On most systems, Chrome updates automatically; however, the update requires a browser restart to take effect. Navigate to
chrome://settings/helpto verify the installed version and force an update check. The fix is documented in the Chrome Stable Channel Update. -
Verify all Chromium-based browsers in your environment, including Microsoft Edge, Brave, Opera, and Vivaldi. These browsers share the Chromium rendering engine and are likely affected by the same vulnerability. Check each browser's update status and ensure they have incorporated the corresponding Chromium patch.
-
Enforce browser update policies across your organization using endpoint management tools such as Group Policy, Intune, or JAMF. Configure automatic updates and set maximum allowed version age to ensure browsers cannot remain unpatched beyond a defined window.
-
Enable Chrome's Site Isolation and verify that it is active by visiting
chrome://process-internals. Site isolation limits the data accessible from a compromised renderer process, reducing the impact of exploitation even if the vulnerability is triggered before patching. -
Monitor for indicators of compromise by reviewing endpoint detection logs for unusual Chrome renderer crashes, unexpected child process creation, or suspicious network connections originating from browser processes. Multiple renderer crashes in close succession from the same user may indicate exploitation attempts.
Technical Details
CVE-2026-2441 is a use-after-free vulnerability in Chrome's CSS processing subsystem, identified by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The flaw resides in the code path that handles CSS style recalculation and layout operations within the Blink rendering engine. During complex CSS operations involving dynamically modified stylesheets or pseudo-elements, a CSS-related object can be freed while a reference to it persists elsewhere in the rendering pipeline.
The exploitation sequence involves crafting an HTML page that triggers a specific sequence of CSS operations designed to cause a race between object deallocation and subsequent access. The attacker constructs DOM and CSS structures that cause the engine to free a style-related object during layout, then immediately triggers another operation that dereferences the freed pointer. By carefully controlling heap layout through JavaScript-driven allocations, the attacker can ensure that attacker-controlled data occupies the freed memory slot, converting the use-after-free into arbitrary code execution within the renderer process.
Chrome's sandbox architecture provides an important secondary defense layer. The renderer process operates under strict sandbox restrictions that limit its ability to interact with the operating system, file system, and other processes. However, the sandbox does not prevent access to web content within the compromised rendering context, and historical precedent shows that sandbox escapes are regularly chained with renderer exploits to achieve full system compromise. The fix in version 145.0.7632.75 addresses the root cause by ensuring proper reference counting and lifetime management of the affected CSS objects, preventing the dangling pointer condition from occurring.
Frequently Asked Questions
What is CVE-2026-2441?
CVE-2026-2441 is a high-severity use-after-free vulnerability in Google Chrome's CSS engine that allows remote code execution inside the browser sandbox when a user visits a malicious web page. It affects Chrome versions prior to 145.0.7632.75.
How is CVE-2026-2441 exploited?
An attacker creates a specially crafted HTML page containing CSS operations that trigger a use-after-free condition in Chrome's rendering engine. When a victim visits or is redirected to this page, the vulnerability is triggered automatically without any further user interaction beyond the initial page load.
Which browsers are affected by CVE-2026-2441?
Google Chrome prior to version 145.0.7632.75 is directly affected. Other Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi that share the same rendering engine version are also potentially vulnerable until they incorporate the upstream fix.
Is there a public exploit for CVE-2026-2441?
Yes, a proof-of-concept exploit has been published on GitHub demonstrating the triggering condition. Combined with CISA's KEV listing, this confirms active exploitation in the wild.
How do I fix CVE-2026-2441?
Update Google Chrome to version 145.0.7632.75 or later. Navigate to chrome://settings/help to check your current version and trigger an automatic update. Restart the browser after the update completes.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.