Google Patches Actively Exploited Chrome Zero-Day (CVE-2026–2441) in CSS Font Processing

Google has released an emergency security update to address CVE-2026–2441, the first Chrome zero-day vulnerability reported in 2026. The flaw, rated high severity with a CVSS score of 8.8, was discovered by security researcher Shaheen Fazim and was being actively exploited in the wild. It affects Chrome versions prior to 145.0.7632.75 on Windows and macOS, and 144.0.7559.75 on Linux.

The vulnerability is a Use-After-Free (UAF) memory corruption bug in Chrome’s handling of Cascading Style Sheets (CSS), specifically within the processing of the @font-feature-values rule. In C++, the language used to build much of Chrome’s rendering engine, developers must manually manage memory. A UAF occurs when a program continues to reference memory after it has been freed, potentially allowing attackers to inject malicious data into that memory space.

In this case, Chrome’s internal font feature map could be modified while it was being iterated over, creating a race condition. If an attacker crafted a malicious webpage that triggered deletion of the map during processing, the browser could continue using a dangling reference. This opened the door to arbitrary code execution within the browser sandbox.

Google’s patch resolves the issue by copying or moving the font feature data into a safe local structure before iteration, preventing external modification during processing. The incident highlights ongoing security risks associated with memory-unsafe languages like C++, and reinforces the importance of timely browser updates. Users of Chrome and other Chromium-based browsers such as Edge, Brave, and Opera are urged to update immediately.