NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Chrome fixes exploited CSS memory flaw CVE-2026-2441

Attackers exploited a flaw in Chrome’s handling of web-page styles that could run code inside its sandbox. Chrome, Edge, Opera and Chromebook fixes followed in February. Install your browser’s latest update and restart it.

What to do

In Chrome, open the menu, choose Help > About Google Chrome, install the latest update and relaunch; the February desktop fixes were 145.0.7632.75/76 for Windows and macOS and 145.0.7632.75 for Linux. Update Edge or Opera through their own update controls, and install available ChromeOS updates on Chromebooks. Ask your IT team to update browsers managed by work.

Check your devices
  • Google Chromefixed in 145.0.7632.75 and later
  • Google Chromefixed in 145.0.7632.76 and later
  • Google Chromefixed in 145.0.7632.75 and later
  • Microsoft Edgefixed in 145.0.3800.58 and later
  • Operafixed in 127.0.5778.64 and later
  • Opera GXfixed in 127.0.5778.67 and later
  • Opera Airfixed in 127.0.5778.66 and later
  • Opera Neonfixed in 127.0.5778.65 and later
  • Operafixed in 95.1 and later
  • ChromeOSfixed in 16552.47.0 and later
  • ChromeOS Flexfixed in 16552.47.0 and later

What’s happening

Google disclosed CVE-2026-2441 on 13 February after confirming exploitation. The high-severity flaw affects CSS, which controls how web pages look. A malicious page could misuse freed memory to run code inside Chrome’s sandbox; this flaw alone does not establish a complete device takeover. Google released desktop Chrome fixes that day, followed by fixes from Microsoft and Opera, and Chromebook Stable and LTS updates later in February. CISA added it to its exploited-vulnerability catalogue on 17 February. As at 3 November, fixes are available for the products and channels listed here; the reviewed sources do not identify the attackers, victims or scale of exploitation. Google specifies Linux version 145.0.7632.75, whereas BleepingComputer and TechRadar report 144.0.7559.75; this record follows Google’s version.

What
Flaw
Affects
Google Chrome, Microsoft Edge, Opera browsers and Google ChromeOS
Affected
Google Chrome before 145.0.7632.75, according to Google's CVE description
Microsoft Edge Stable and Extended Stable channels
Opera One, Opera GX, Opera Air, Opera Neon and Opera for Android; affected version ranges not specified in Opera's notice
ChromeOS and ChromeOS Flex Stable, and ChromeOS LTS 138
Fixed in
Google Chrome 145.0.7632.75/76 for Windows and macOS
Google Chrome 145.0.7632.75 for Linux
Microsoft Edge Stable 145.0.3800.58
Microsoft Edge Extended Stable 144.0.3719.130
Opera One 127.0.5778.64
Opera GX 127.0.5778.67
Opera Air 127.0.5778.66
Opera Neon 127.0.5778.65
Opera for Android 95.1
ChromeOS and ChromeOS Flex Stable 16552.47.0, browser 145.0.7632.154
ChromeOS LTS 138: browser 138.0.7204.305, platform 16295.90.0
CVE
CVE-2026-2441
Since
13 Feb 2026
Closed
27 Feb 2026

Timeline

  1. New fixFixed

    Google released the fix for the ChromeOS LTS 138 channel in browser version 138.0.7204.305, platform version 16295.90.0.

  2. New fix

    Google listed CVE-2026-2441 among the fixes in ChromeOS and ChromeOS Flex Stable version 16552.47.0, containing browser version 145.0.7632.154.

  3. CISA added

    CISA added CVE-2026-2441 to its Known Exploited Vulnerabilities catalogue, with a 10 March remediation deadline for US federal civilian agencies.

  4. New fix

    Microsoft released Edge Extended Stable 144.0.3719.130 with the fix for CVE-2026-2441.

  5. New fix

    Opera confirmed fixes in Opera One 127.0.5778.64, GX 127.0.5778.67, Air 127.0.5778.66, Neon 127.0.5778.65 and Opera for Android 95.1.

  6. New fix

    Microsoft released Edge Stable 145.0.3800.58 with the fix. Its Extended Stable channel received the fix three days later.

  7. Made publicPartly fixed

    Google disclosed CVE-2026-2441, confirmed exploitation and released Chrome 145.0.7632.75/76 for Windows and macOS and 145.0.7632.75 for Linux. Researcher Shaheen Fazim had reported the flaw on 11 February.

Sources

  1. Stable Channel Update for DesktopGoogle · 13 Feb 2026
  2. Release notes for Microsoft Edge Security UpdatesMicrosoft · 17 Feb 2026
  3. Update your browser: Security fix for Chrome zero-day CVE-2026-2441Opera · 16 Feb 2026
  4. Chrome Releases: February 2026 — ChromeOS Stable and LTS updatesGoogle · 27 Feb 2026
  5. CVE-2026-2441 DetailNIST NVD · 17 June 2026
  6. Google patches first Chrome zero-day exploited in attacks this yearBleepingComputer · 16 Feb 2026
  7. Google patches first Chrome zero-day of the year - so update now or face attackTechRadar · 16 Feb 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from February 2026 · JSON · RSS