{"id":"chrome-exploited-css-flaw-feb-2026","category":"patch","status":"closed","title":"Chrome fixes exploited CSS memory flaw CVE-2026-2441","tldr":"Attackers exploited a flaw in Chrome’s handling of web-page styles that could run code inside its sandbox. Chrome, Edge, Opera and Chromebook fixes followed in February. Install your browser’s latest update and restart it.","summary":"Google disclosed CVE-2026-2441 on 13 February after confirming exploitation. The high-severity flaw affects CSS, which controls how web pages look. A malicious page could misuse freed memory to run code inside Chrome’s sandbox; this flaw alone does not establish a complete device takeover. Google released desktop Chrome fixes that day, followed by fixes from Microsoft and Opera, and Chromebook Stable and LTS updates later in February. CISA added it to its exploited-vulnerability catalogue on 17 February. As at 3 November, fixes are available for the products and channels listed here; the reviewed sources do not identify the attackers, victims or scale of exploitation. Google specifies Linux version 145.0.7632.75, whereas BleepingComputer and TechRadar report 144.0.7559.75; this record follows Google’s version.","action":"In Chrome, open the menu, choose Help > About Google Chrome, install the latest update and relaunch; the February desktop fixes were 145.0.7632.75/76 for Windows and macOS and 145.0.7632.75 for Linux. Update Edge or Opera through their own update controls, and install available ChromeOS updates on Chromebooks. Ask your IT team to update browsers managed by work.","product":"Google Chrome, Microsoft Edge, Opera browsers and Google ChromeOS","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-2441"],"tags":["google","chrome","chromium","browser","zero-day","memory-corruption"],"affected":["Google Chrome before 145.0.7632.75, according to Google's CVE description","Microsoft Edge Stable and Extended Stable channels","Opera One, Opera GX, Opera Air, Opera Neon and Opera for Android; affected version ranges not specified in Opera's notice","ChromeOS and ChromeOS Flex Stable, and ChromeOS LTS 138"],"fixed":["Google Chrome 145.0.7632.75/76 for Windows and macOS","Google Chrome 145.0.7632.75 for Linux","Microsoft Edge Stable 145.0.3800.58","Microsoft Edge Extended Stable 144.0.3719.130","Opera One 127.0.5778.64","Opera GX 127.0.5778.67","Opera Air 127.0.5778.66","Opera Neon 127.0.5778.65","Opera for Android 95.1","ChromeOS and ChromeOS Flex Stable 16552.47.0, browser 145.0.7632.154","ChromeOS LTS 138: browser 138.0.7204.305, platform 16295.90.0"],"matches":[{"platform":"windows","app":"Google Chrome","bundle":"","fixed":"145.0.7632.75"},{"platform":"macos","app":"Google Chrome","bundle":"com.google.Chrome","fixed":"145.0.7632.76"},{"platform":"linux","app":"Google Chrome","bundle":"","fixed":"145.0.7632.75"},{"platform":"edge","app":"Microsoft Edge","bundle":"","fixed":"145.0.3800.58"},{"platform":"other","app":"Opera","bundle":"","fixed":"127.0.5778.64"},{"platform":"other","app":"Opera GX","bundle":"","fixed":"127.0.5778.67"},{"platform":"other","app":"Opera Air","bundle":"","fixed":"127.0.5778.66"},{"platform":"other","app":"Opera Neon","bundle":"","fixed":"127.0.5778.65"},{"platform":"android","app":"Opera","bundle":"","fixed":"95.1"},{"platform":"other","app":"ChromeOS","bundle":"","fixed":"16552.47.0"},{"platform":"other","app":"ChromeOS Flex","bundle":"","fixed":"16552.47.0"}],"sources":[{"kind":"advisory","title":"Stable Channel Update for Desktop","url":"https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html","by":"Google","date":"2026-02-13"},{"kind":"advisory","title":"Release notes for Microsoft Edge Security Updates","url":"https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security","by":"Microsoft","date":"2026-02-17"},{"kind":"advisory","title":"Update your browser: Security fix for Chrome zero-day CVE-2026-2441","url":"https://blogs.opera.com/security/2026/02/update-your-browser-security-fix-for-chrome-zero-day-cve-2026-2441/","by":"Opera","date":"2026-02-16"},{"kind":"advisory","title":"Chrome Releases: February 2026 — ChromeOS Stable and LTS updates","url":"https://chromereleases.googleblog.com/2026/02/","by":"Google","date":"2026-02-27"},{"kind":"advisory","title":"CVE-2026-2441 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2026-2441","by":"NIST NVD","date":"2026-06-17"},{"kind":"news","title":"Google patches first Chrome zero-day exploited in attacks this year","url":"https://www.bleepingcomputer.com/news/security/google-patches-first-chrome-zero-day-exploited-in-attacks-this-year/","by":"BleepingComputer","date":"2026-02-16"},{"kind":"news","title":"Google patches first Chrome zero-day of the year - so update now or face attack","url":"https://www.techradar.com/pro/security/google-patches-first-chrome-zero-day-of-the-year-so-update-now-or-face-attack","by":"TechRadar","date":"2026-02-16"}],"started":"2026-02-13","closed":"2026-02-27","created":"2026-11-03T20:58:20.638Z","updated":"2026-11-03T20:58:20.638Z","cve_notes":[{"cve":"CVE-2026-2441","name":"Use-after-free in Chrome’s CSS handling","what":"Chrome’s CSS handling can reuse memory after it has been freed, allowing a malicious web page to run an attacker’s code inside the browser sandbox.","severity":"high","cvss":8.8}],"timeline":[{"at":"2026-02-27","added":"2026-11-03T20:51:54.186Z","kind":"new-fix","text":"Google released the fix for the ChromeOS LTS 138 channel in browser version 138.0.7204.305, platform version 16295.90.0.","url":"https://chromereleases.googleblog.com/2026/02/","by":"Google","patch":"patched"},{"at":"2026-02-26","added":"2026-11-03T20:51:54.186Z","kind":"new-fix","text":"Google listed CVE-2026-2441 among the fixes in ChromeOS and ChromeOS Flex Stable version 16552.47.0, containing browser version 145.0.7632.154.","url":"https://chromereleases.googleblog.com/2026/02/","by":"Google","patch":null},{"at":"2026-02-17","added":"2026-11-03T20:51:54.186Z","kind":"cisa-added","text":"CISA added CVE-2026-2441 to its Known Exploited Vulnerabilities catalogue, with a 10 March remediation deadline for US federal civilian agencies.","url":"https://nvd.nist.gov/vuln/detail/cve-2026-2441","by":"NIST NVD","patch":null},{"at":"2026-02-17","added":"2026-11-03T20:51:54.186Z","kind":"new-fix","text":"Microsoft released Edge Extended Stable 144.0.3719.130 with the fix for CVE-2026-2441.","url":"https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security","by":"Microsoft","patch":null},{"at":"2026-02-16","added":"2026-11-03T20:51:54.186Z","kind":"new-fix","text":"Opera confirmed fixes in Opera One 127.0.5778.64, GX 127.0.5778.67, Air 127.0.5778.66, Neon 127.0.5778.65 and Opera for Android 95.1.","url":"https://blogs.opera.com/security/2026/02/update-your-browser-security-fix-for-chrome-zero-day-cve-2026-2441/","by":"Opera","patch":null},{"at":"2026-02-14","added":"2026-11-03T20:51:54.186Z","kind":"new-fix","text":"Microsoft released Edge Stable 145.0.3800.58 with the fix. Its Extended Stable channel received the fix three days later.","url":"https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security","by":"Microsoft","patch":null},{"at":"2026-02-13","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"Google disclosed CVE-2026-2441, confirmed exploitation and released Chrome 145.0.7632.75/76 for Windows and macOS and 145.0.7632.75 for Linux. Researcher Shaheen Fazim had reported the flaw on 11 February.","url":"https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html","by":"Google","patch":"partial"}],"url":"https://hard.fyi/live/chrome-exploited-css-flaw-feb-2026/","json":"https://hard.fyi/api/live?id=chrome-exploited-css-flaw-feb-2026"}