CVE-2026-2441

Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Affected

Google · Chrome

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

54.96% chance of exploitation in the next 30 days, 99th percentile

CISA KEV

added 2026-02-17

Published

2026-02-13

Updated

2026-09-21

Proof-of-concept exploits (7)

• huseyinstif/CVE-2026-2441-PoC137★ · 2026-02-18
• NetVanguard-cmd/CVE-2026-24410★ · 2026-02-24
• D3b0j33t/CVE-2026-2441-PoC0★ · 2026-03-01
• theemperorspath/CVE-2026-2441-PoC0★ · 2026-02-19
• MartinaStarone/CVE-2026-24410★ · 2026-05-19
• atiilla/CVE-2026-2441_PoC0★ · 2026-02-23
• FreeBSDKernel9-0/Proof-Of-Concepts-Releases-For-PS43★ · 2026-08-18

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52542

Security advisories

• https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html
• https://issues.chromium.org/issues/483569511

References

• CVE Record
• NVD entry

Related

• CVE-2025-11371
• CVE-2025-59536
• CVE-2026-21531
• CVE-2026-27597
• CVE-2026-3055
• CVE-2026-4447