Google Chromium CSS Use-After-Free Vulnerability (CVE-2026-2441)

What is affected, what to do

Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Conflicting version data — version display is hidden until the data is resolved.

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Update Google Chrome now: Move desktop clients to at least 145.0.7632.75 or 145.0.7632.76 (depending on platform); the Extended Stable channel is fixed from 144.0.7559.75. The fix only takes effect after a browser restart. Force it via policy (RelaunchNotification = 2, RelaunchNotificationPeriod e.g. 3600000 ms).
   • Update Microsoft Edge to 145.0.3800.58 or later via Intune/WSUS/Configuration Manager or the Edge update service, also with an enforced relaunch.
   • Inventory other Chromium-based browsers (Opera, Brave, Vivaldi, etc.): a patch is available from the vendor — look up the fixed version in the vendor advisory. Block unpatched variants with application control (AppLocker/WDAC) until they are updated.
   • Verify fleet-wide version state, e.g. via Defender TVM (DeviceTvmSoftwareInventory | where SoftwareName has_any ("chrome","edge") | summarize by DeviceName, SoftwareVersion). Raise tickets for hosts below the fixed build.
   • Prioritise privileged users' endpoints: Patch admin workstations, jump hosts and machines with access to OT or critical-infrastructure segments first. Prohibit internet browsing on them until they are patched.
2. 02

   Runbook step 2

   Mitigation layers

   • Configuration management: Remove version pinning (leave TargetVersionPrefix unset or raise it to 145) and keep auto-update enabled (UpdateDefault = 1 for Chrome and Edge). Prevent users from deferring updates.
   • Network/proxy layer: Block uncategorised and newly registered domains (NRD < 30 days) as well as ad networks with a malvertising history. Where available, route unknown categories through remote browser isolation. The bug is triggered by crafted HTML pages, typically delivered via drive-by or watering-hole campaigns.
   • Browser hardening: For high-risk users, restrict JavaScript on untrusted sites with DefaultJavaScriptSetting = 2 and allow-list business sites via JavaScriptAllowedForUrls. Do not weaken Site Isolation policies. Enable Edge "Enhanced Security Mode" (EnhanceSecurityMode = 2, strict).
   • Endpoint hardening against the next stage: The flaw yields code execution inside the renderer sandbox. Attackers usually chain it with a sandbox escape or a local privilege escalation. Keep OS patches current, remove local admin rights, enable ASR rules (e.g. "Block executable files unless they meet prevalence, age or trusted list criterion") and enforce WDAC/AppLocker on user-writable paths.
   • Embedded Chromium engines: Electron and CEF applications (collaboration clients, kiosk/HMI front-ends) may ship the vulnerable code. Request vendor updates and restrict those hosts to the network destinations they actually need.
3. 03

   Runbook step 3

   Detection rules

   • EDR process ancestry (Sysmon EID 1 / DeviceProcessEvents): Treat shell or LOLBin children of browser processes as suspicious. KQL: DeviceProcessEvents | where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","opera.exe") and FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","mshta.exe","wscript.exe","regsvr32.exe").
   • Renderer crashes as an early signal: Windows Event ID 1000/1001 (Application Error / WER) for chrome.exe or msedge.exe with exception code 0xc0000005 clusters around failed heap-exploitation attempts. Investigate repeated crashes on a single host and correlate them with proxy logs.
   • File system (Sysmon EID 11): Flag executables (.exe, .dll, .ps1, .hta) written by a browser process outside the Downloads folder, e.g. in %TEMP%, %APPDATA% or C:\ProgramData. Sigma shape: Image|endswith: '\chrome.exe' AND TargetFilename|endswith: ['.exe','.dll'] AND NOT TargetFilename|contains: '\Downloads\'.
   • Network telemetry (Zeek/Suricata, proxy): Watch for new outbound connections from non-browser processes on the same host shortly after NRD visits (Sysmon EID 3). Also look for unusual redirect chains (multiple HTTP 302 hops across ad or TDS domains) in proxy logs.
   • Compliance detection: A daily SIEM report on proxy User-Agent strings showing Chrome major version < 145, or a build below the fixed version, surfaces unmanaged and unpatched clients (shadow IT, BYOD).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Source: BSI CSAF, BSI WID Portal, pwn.watch, Microsoft Security Update Guide, cvelistv5, NVD (NIST), CISA KEV Catalog, Debian Security Advisories, CVE.org (MITRE)

Vendors and products

• Debian Chromium
• Google Google Chrome
• Microsoft Microsoft Edge

Weakness classes (CWE)

• CWE-416Use After Free

  Variant

  The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

  Entry at MITRE CWE-416

References & sources

• chromereleases.googleblog.com2026/02/stable-channel-update-for-desktop_13.htmlRelease notes
• issues.chromium.orgissues/483569511Issue tracking, Permissions required
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-2441government-resource, US government resource
• github.comhuseyinstif/CVE-2026-2441-PoC/blob/main/poc.htmlExploit, Exploit
• pwn.watchpwn.watch: Chrome zero-day CVE-2026-2441 (CSS use-after-free)pwn-watch
• securityweek.comSecurityWeek: first Chrome zero-day 2026pwn-watch