New Chrome Zero-Day (CVE-2026-2441) Under Active Attack — Patch Released
Google rolled out security updates for the Chrome browser on Friday to close a vulnerability that the company says has been used in real-world attacks. The flaw is tracked as CVE-2026-2441 and carries a CVSS score of 8.8. It was reported to Google by security researcher Shaheen Fazim on February 11, 2026.
The issue has been classified as a use-after-free weakness in the browser’s CSS handling. According to the entry for CVE-2026-2441 in the NIST National Vulnerability Database, the bug could allow a remote attacker, using a specially crafted HTML page, to run arbitrary code inside Chrome’s sandbox.
Google confirmed that an exploit for this vulnerability exists in the wild but has not published specifics about how the flaw is being weaponized, who is exploiting it, or which targets may have been affected. The company’s limited disclosure nevertheless underscores the continued appeal of browser vulnerabilities to adversaries, since browsers are widely deployed and present a broad attack surface.
This patch represents the first actively exploited Chrome zero-day that Google has fixed in 2026. For context, in 2025 the company issued fixes for eight zero-day defects in Chrome that were either actively abused or demonstrated via proof-of-concept exploits.
In a related wave of vendor updates, Apple last week released fixes across iOS, iPadOS, macOS Tahoe, tvOS, watchOS, and visionOS to remediate a zero-day tracked as CVE-2026-20700 (CVSS 7.8). Apple said that vulnerability had been exploited in an “extremely sophisticated” campaign to execute arbitrary code on vulnerable devices running versions earlier than iOS 26 and that specific individuals were targeted.
To protect systems from CVE-2026-2441, users should update Chrome to the patched builds: 145.0.7632.75 or 145.0.7632.76 on Windows and macOS, and 144.0.7559.75 on Linux. To check for and apply the update, open Chrome, go to More > Help > About Google Chrome and click Relaunch when the update completes.
Administrators and users of other Chromium-based browsers – including Microsoft Edge, Brave, Opera, and Vivaldi – should watch for their vendors’ security advisories and install corresponding fixes as they are released.
Keeping browsers up to date is a key step in reducing exposure to remote code execution and other browser-based threats. For more detail on the technical description of the issue, see the NVD entry linked above and Google’s Chrome release notes.