Chrome
CVE-2026-2441
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious HTML page with CSS
-
ExploitUser visits page in Chrome browser
-
ExecutionTrigger use-after-free in CSS parser
-
ImpactExecute arbitrary code in sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | User must open attacker-controlled HTML page in Google Chrome prior to version 145.0.7632.75. CSS parsing must occur during page rendering. Sandbox confinement applies but code execution occurs within it. |
| Impact | CVSS 8.8 (High). KEV-listed — actively exploited. Public PoC available. Code execution within sandbox (chainable with escape). Affects Chrome and all Chromium-based browsers (Edge, Opera, Brave). Drive-by exploitation — no user interaction beyond visiting a page. |
| Exploit ScenarioDerived | An attacker creates a webpage with crafted HTML/CSS that triggers the use-after-free in Chrome's CSS engine. When a user visits this page (through phishing, malvertising, or compromised legitimate sites), the vulnerability is exploited to gain code execution within Chrome's renderer process. While sandboxed, this can be chained with a sandbox escape vulnerability for full system access, or used standalone for attacks within the renderer (stealing page data, credentials from other tabs via Spectre-class attacks). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Google Chrome's CSS engine contains a use-after-free vulnerability (CVE-2026-2441, CVSS 8.8) that allows remote attackers to execute arbitrary code within the browser sandbox through crafted HTML pages. KEV-listed with public PoC, this vulnerability enables drive-by exploitation when users visit malicious or compromised websites.
Earlier versions of this analysis (1)
Chrome's CSS rendering engine contains a use-after-free vulnerability (CWE-416) where a CSS object is freed but subsequently accessed, enabling heap corruption and arbitrary code execution within the renderer sandbox.
RemediationAI
Update Chrome to 145.0.7632.75 or later immediately. Ensure auto-update is enabled. Enterprise: push Chrome updates via Group Policy. Also update all Chromium-based browsers. Consider browser isolation solutions for high-risk browsing.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The use-after-free occurs in Chrome's CSS layout engine during processing of certain CSS property combinations. When a specific sequence of DOM and CSS operations is performed, a CSS-related object is freed prematurely while still referenced by the layout engine. Subsequent access to the freed memory enables heap corruption. While Chrome's multi-process sandbox limits the immediate impact, this can be chained with a sandbox escape for full system compromise.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
Executive ViewAI
A critical vulnerability in Google Chrome (CVE-2026-2441) is being actively exploited in the wild to execute arbitrary code, affecting all users on versions prior to 145.0.7632.75. With no patch currently available and public exploits circulating, this poses an immediate risk to any organization relying on Chrome for business operations, particularly those handling sensitive data or accessing critical systems.
Deploy browser isolation solutions (cloud-based or local sandboxing); implement Content Security Policy (CSP) headers and Web Application Firewall (WAF) rules to block known exploit vectors; disable JavaScript in non-essential applications; use endpoint detection and response (EDR) tools to monitor for post-exploitation activity; restrict Chrome to low-privilege user accounts; consider alternative browsers (Firefox, Edge, Safari) for sensitive operations; enforce DNS filtering and network segmentation to isolate affected systems; disable HTML5 features if operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Affected Products (CPE)CVE.org
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP6 | Fixed |