highclosedpatched
Chrome zero-day CVE-2026-2441 (CSS use-after-free)
› Google Chrome / Chromium
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Feb 13, 2026
- closed
- Feb 16, 2026
- CVEs
- 1
- sources
- 1
## summary
First actively exploited Chrome zero-day of 2026. Google patched CVE-2026-2441, a high-severity use-after-free in CSS (CSSFontFeatureValuesMap), in mid-February Chrome 145 updates. Google stated an exploit existed in the wild.
severity: High (CVSS 8.8); exploited in the wild
## cve ids[1]
## affected
- Before Chrome 145.0.7632.75/.76 (Win/Mac) and related Linux builds
## fixed in
- 145.0.7632.75+
- 144.0.7559.75+ (Linux per reports)
## news & write-ups[1]
## notes & caveats
Verify primary vendor advisory for exact fixed versions; facts taken from public sources listed in links.
