CVE-2026-2441: 
vulnerability analysis and mitigation

CVE-2026-2441 is a use-after-free (UAF) vulnerability in the CSS engine of Google Chrome that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. The vulnerability was reported by researcher Shaheen Fazim on February 11, 2026, and Google disclosed and patched it on February 13, 2026, in Chrome 145.0.7632.75/76 (Chrome Releases). It affects all Google Chrome versions prior to 145.0.7632.75 (Linux) and 145.0.7632.76 (Windows/macOS), as well as Microsoft Edge Chromium-based builds (Microsoft MSRC). The vulnerability carries a CVSS v3.1 base score of 8.8 (High), reflecting its network-based, low-complexity, user-interaction-required attack profile (Feedly).

The root cause is a use-after-free condition (CWE-416) in Blink's CSSFontFeatureValuesMap implementation, specifically in css_font_feature_values_map.cc. When CreateIterationSource() is called, it stores a raw pointer (aliases_) to the internal FontFeatureAliases HashMap; if the map is mutated (via delete() or set()) during iteration, the HashMap rehashes and reallocates its internal storage, leaving aliases_ and the active iterator as dangling pointers. A subsequent call to FetchNextItem() then reads through freed memory, constituting a classic UAF. The fix involved changing the raw pointer reference to a deep copy of the FontFeatureAliases object (commit 63f3cb4864c64c677cd60c76c8cb49d37d08319c). Exploitation requires only that a victim visit a crafted HTML page containing malicious CSS and JavaScript that triggers the iterator invalidation (PoC GitHub).

Successful exploitation allows a remote attacker to achieve arbitrary code execution within the Chrome renderer sandbox, with potential for heap corruption. While the initial impact is sandboxed code execution, this can serve as a stepping stone for sandbox escape when chained with additional privilege escalation exploits, potentially leading to full system compromise. The vulnerability affects all major platforms (Windows, macOS, Linux) running unpatched Chrome or Chromium-based browsers, including Microsoft Edge and Opera, exposing billions of users to risk (CISA KEV, Chrome Releases).

CVE-2026-2441 was actively exploited in the wild at the time of disclosure, with Google confirming exploit existence in its release notes (Chrome Releases). Multiple public proof-of-concept exploits were published on GitHub within days of disclosure, including detailed HTML/JavaScript PoC files demonstrating the UAF trigger via CSSFontFeatureValuesMap iterator invalidation (PoC GitHub, b1gchoi PoC). CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on February 17, 2026, with a remediation due date of March 10, 2026, and noted potential use in ransomware campaigns (CISA KEV). Threat intelligence links the vulnerability to malware families including ChromeUpdate and Keenadu. The EPSS score is approximately 0.53%, though active exploitation and KEV listing indicate elevated real-world risk (Feedly).

1. Reconnaissance: Identify targets running Google Chrome versions prior to 145.0.7632.75 or Chromium-based browsers (Edge, Opera) on any platform. Tools like Shodan or passive fingerprinting via browser user-agent strings can assist.
2. Craft malicious HTML page: Create an HTML page that defines a @font-feature-values CSS rule with a @styleset block containing multiple entries, exposing a CSSFontFeatureValuesMap object via the CSSOM API (rule.styleset).
3. Heap grooming: Instantiate 50+ additional @font-feature-values rules via JavaScript to allocate same-sized FontFeatureAliases objects on the heap, creating a predictable memory layout for post-free reclamation.
4. Trigger UAF: Obtain an iterator over the map (map.entries()), then interleave iterator.next() calls with map.delete(key) and mass map.set() calls (512+ entries per step) to force a HashMap rehash. This frees the internal storage while the iterator's raw pointer (aliases_) still references it.
5. Memory reclamation: Use the groom objects to fill the freed memory region with attacker-controlled data, enabling type confusion or controlled memory reads/writes.
6. Achieve code execution: Leverage the corrupted heap state to redirect execution flow within the renderer process, achieving arbitrary code execution inside the Chrome sandbox. Further sandbox escape would require chaining with an additional privilege escalation vulnerability (PoC GitHub).

• Network: Unexpected outbound connections from the Chrome renderer process to unknown external IPs or C2 infrastructure; HTTP/HTTPS requests to attacker-controlled domains serving crafted HTML pages with embedded @font-feature-values CSS rules.
• Process: Unusual child processes spawned by chrome.exe or chromium (e.g., cmd.exe, powershell.exe, bash, curl, wget); renderer process crashes (chrome_child.dll or libchrome.so crash dumps) with stack traces referencing CSSFontFeatureValuesMap or css_font_feature_values_map.cc.
• Logs: Chrome crash reports or minidumps referencing use-after-free in CSS-related modules; browser telemetry showing repeated renderer crashes on specific URLs.
• File System: Unexpected files written by the Chrome renderer process to user-accessible directories; new scheduled tasks, startup entries, or persistence mechanisms created shortly after browser activity.
• Memory Artifacts: Heap corruption patterns in Chrome renderer memory dumps involving FontFeatureAliases HashMap structures; evidence of heap spray patterns (large numbers of similarly-sized allocations).

The primary remediation is to update Google Chrome to version 145.0.7632.75 (Linux) or 145.0.7632.76 (Windows/macOS) or later immediately (Chrome Releases). Microsoft Edge Chromium users should apply the corresponding Edge update available via the Microsoft Security Response Center (Microsoft MSRC). Organizations should enforce browser update policies to ensure timely patching across all endpoints, prioritizing this update given active exploitation and CISA KEV listing with a due date of March 10, 2026 (CISA KEV). As a temporary measure, consider restricting access to untrusted websites or deploying browser isolation solutions until patching is complete. Debian, Fedora, openSUSE, and other Linux distributions also released updated Chromium packages addressing this vulnerability.

Google's disclosure confirmed active exploitation at the time of patching, triggering widespread media coverage from outlets including BleepingComputer, The Hacker News, The Register, Forbes, and SecurityWeek, all urging immediate updates (BleepingComputer, The Hacker News). CISA's rapid addition to the KEV catalog on February 17, 2026 — just four days after the patch — underscored the severity and urgency (CISA KEV). Security researchers and community members on Reddit, Mastodon, and Bluesky highlighted the novelty of a CSS-engine zero-day and discussed the technical mechanics of the CSSFontFeatureValuesMap UAF. Opera also published a security advisory urging users to update their Chromium-based browser, and CSS-Tricks published an analysis of the exploit mechanism (Opera Security, CSS-Tricks).