Security Advisory: Google Chrome CVE-2026-2441 Zero-Day Vulnerability Actively Exploited, Immediate Update Required

Overview of CVE-2026-2441

Google has confirmed active exploitation of CVE-2026-2441, a use-after-free vulnerability in Chrome's CSS component. This flaw enables remote attackers to execute arbitrary code within the browser sandbox simply by tricking users into visiting a specially crafted HTML page. It carries a high CVSS severity score of 8.8. (helpnetsecurity.com)

Reported by researcher Shaheen Fazim on February 11, 2026, the vulnerability has seen active exploitation in the wild. Google promptly released a security update on February 13, 2026, to patch it. (helpnetsecurity.com)

This vulnerability affects Chrome versions earlier than 145.0.7632.75 on Windows and macOS, and versions before 144.0.7559.75 on Linux. (notebookcheck.net)

Exploitation may result in arbitrary code execution inside the browser's sandbox, potentially compromising the user's browser session. (sentinelone.com)

The vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog, highlighting its critical status. (sentinelone.com)

Recommended Actions

Google has released Chrome versions 145.0.7632.75 and 145.0.7632.76 for Windows and macOS, and version 144.0.7559.75 for Linux to fix CVE-2026-2441. (notebookcheck.net)

Users should go to the 'About Google Chrome' section within their browser settings to verify they are running the latest version and apply any pending updates immediately.

Organizations must confirm that all managed devices have been updated to these patched versions. Enabling automatic updates wherever feasible helps maintain ongoing protection.

Staying current by regularly monitoring official security advisories and applying updates without delay is crucial to defend against emerging threats.

Maintaining Security Posture

The discovery of CVE-2026-2441 underlines how important it is to keep software updated to reduce security risks.

Users should exercise caution when browsing unfamiliar websites and avoid clicking on suspicious links to lower the chance of exploitation.

Organizations should enforce robust security policies that include regular software updates, endpoint protections, and user training to strengthen their overall security posture.

Sources

This post was generated from verified public reporting and primary source material. The links below are the core references used in the final review.

• Security Advisory: Google Chrome CVE-2026-2441 (Zero Day) - DataComm Networks Incorporated from DataComm Networks Incorporated. Provides official advisory on CVE-2026-2441, including mitigation steps.
• Google patches Chrome vulnerability with in-the-wild exploit (CVE-2026-2441) - Help Net Security from Help Net Security. Details on the vulnerability and its active exploitation.
• Update Chrome now: Zero-day bug allows code execution via malicious webpages | Malwarebytes from Malwarebytes. Explains the nature of the zero-day vulnerability and its risks.