HIGH
CVE-2026-2441
CVSS
8.8
KEV
Description
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Summary dbcve.org
Use-after-free vulnerability in the CSS rendering component of Google Chrome (or Chromium-based browser) prior to version 145.0.7632.75. A remote attacker can exploit this by tricking a user into visiting a crafted HTML page, potentially achieving arbitrary code execution within the sandboxed browser process.
Mitigation
Upgrade to Chrome version 145.0.7632.75 or later, or apply the vendor-supplied security patch. Until patched, restrict user access to untrusted HTML content and ensure sandboxing is enabled.
Weakness (CWE)
CWE-416
Use After Free
EPSS Score
22.38%
Probability of exploitation in next 30 days
97.6th percentile
References
https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html
Release Notes
https://issues.chromium.org/issues/483569511
Issue Tracking, Permissions Required
https://github.com/huseyinstif/CVE-2026-2441-PoC/blob/main/poc.html
Exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-2441
US Government Resource
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.