Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-2441 8.8
Google · Chromium · Added 2026-02-17 · Published 2026-02-13
3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityGoogle Chromium CSS Use-After-Free Vulnerability
VendorGoogle
ProductChromium
Date added2026-02-17
Due date2026-03-10
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-416
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Descriptions

KEV: Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

NVD: Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Compliance SSVC + BOD 26-04

Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required

Research metadata

Last researched2026-08-28 22:42 UTC
Wall time22.8s
Searches3
Component defaultyes
Sources https://nvd.nist.gov/vuln/detail/CVE-2026-2441
https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html
https://github.com/advisories/GHSA-xpp8-qpcr-c3rg
https://github.com/huseyinstif/CVE-2026-2441-PoC
https://www.exploit-db.com/exploits/52542
https://issues.chromium.org/issues/483569511
https://www.malwarebytes.com/blog/news/2026/02/update-chrome-now-zero-day-bug-allows-code-execution-via-malicious-webpages

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)
warn component_extraction: Component 'Chromium CSS engine (Blink rendering engine) — CSSFontFeatureValuesMap in css_font_feature_values_map.cc' matches or contains product name 'Chromium' — no specific component identified

Hunting hypothesis agent

Hunt Chrome crashes for STATUS_ACCESS_VIOLATION in CSSFontFeatureValuesMap::FetchNextItem; @font-feature-values rules trigger iterator UAF via map.set()/delete() with heap grooming — check Blink sigs for css_font_feature_values_map.cc.

Research details

ComponentChromium CSS engine (Blink rendering engine) — CSSFontFeatureValuesMap in css_font_feature_values_map.cc
PreconditionsUser must visit or be redirected to a crafted HTML page in a vulnerable Chromium-based browser (Chrome < 145.0.7632.75, Edge prior to Chromium 145 update, Opera < 127.0.5778.64); CSS rendering must be enabled (default in all browsers); JavaScript must be enabled to trigger the iterator mutation and heap grooming; No additional privileges or user interaction beyond visiting the page required (UI:R in CVSS reflects user navigation). agent
Deliverycrafted HTML page
Public PoCyes
PoC URLs https://github.com/huseyinstif/CVE-2026-2441-PoC
https://github.com/theemperorspath/CVE-2026-2441-PoC
https://github.com/D3b0j33t/CVE-2026-2441-PoC
https://github.com/MartinaStarone/CVE-2026-2441
https://www.exploit-db.com/exploits/52542 Third-party repos; verify before use.
Advisoryhttps://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html
Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 8.8). The vulnerability is a deterministic UAF caused by iterator invalidation during HashMap rehashing. Multiple public PoCs demonstrate reliable crash triggering through three methods: (1) for...of loop with concurrent map.delete/set causing rehash, (2) for...of with mass insertion (512 entries) to force rehash, (3) requestAnimationFrame + layout recalculation combined with mutation. PoCs include heap grooming (50 same-sized @font-feature-values rules) to make heap layout predictable for exploitation. Achieving full sandbox escape requires a separate vulnerability, but renderer-level RCE enables credential theft, session hijacking, and further exploitation.
SummaryCVE-2026-2441 is a high-severity (CVSS 8.8) use-after-free (UAF) vulnerability in Google Chrome's Blink CSS engine, specifically in the CSSFontFeatureValuesMap implementation (third_party/blink/renderer/core/css/css_font_feature_values_map.cc). The FontFeatureValuesMapIterationSource stored a raw pointer (const FontFeatureAliases* aliases_) to the internal HashMap. When the map is mutated during iteration via set() or delete(), the HashMap rehashes — allocating new storage and freeing the old — causing the raw pointer to become dangling. The next FetchNextItem() call reads from freed memory. A remote attacker can trigger this via a crafted HTML page using @font-feature-values CSS rules combined with iterator mutation, leading to arbitrary code execution within the Chrome sandbox (renderer process). Google confirmed active exploitation in the wild as a zero-day before the patch was released. Discovered by Shaheen Fazim (reported 2026-02-11), patched in Chrome 145.0.7632.75 on 2026-02-13 (fix commit 63f3cb4864c64c677cd60c76c8cb49d37d08319c). Multiple public PoCs exist demonstrating crash and exploitation. Affects all Chromium-based browsers using the vulnerable Blink version (Chrome < 145.0.7632.75, Edge prior to Chromium 145 update, Opera < 127.0.5778.64). CISA added to KEV on 2026-02-17.

Tia coverage

First reported2026-06-09
First exploit report2026-06-09
Exploit report → KEV112 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

google-fixes-actively-exploited-android-zero-day-on-pixel-devicegoogle-patches-5th-chrome-zero-day-of-2026-cve-2026-11645-v8-eng

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub