Zero-day CSS: CVE-2026-2441 exists in the wild

chromereleases.googleblog.com

148 points by idoxer 3 hours ago


mpeg - 2 hours ago

"Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera."

That's pretty bad! I wonder what kind of bounty went to the researcher.

tripplyons - 3 hours ago

"Use after free in CSS" is a funny description to see.

himata4113 - 2 hours ago

The fact that these still show up is pretty wild to me. Don't we have a bunch of tools that should create memory-safish binaries by applying the same validation checks that memory-safe languages get for free purely from their design?

I get that css has changed a lot over the years with variables, scopes and adopting things from less/sass/coffee, but people use no-script for the reason because javascript is risky, but what if css can be just as risky... time to also have no-style?

Honestly, pretty excited for the full report since it's either stupid as hell or a multi-step attack chain.

ripbozo - 2 hours ago

I'd love to see what the PoC code looks like, of course after the patch has been rolled out for a few weeks.

jijji - 6 minutes ago

use after free.... ahh the irony

bitbasher - 2 hours ago

Maybe Chromium should also rewrite their rendering engine in Rust ;p

- 3 hours ago
[deleted]
astrobe_ - 2 hours ago

This doesn't affect the many browsers based on Chromium?

MallocVoidstar - 2 hours ago

Devtools is seemingly partially broken in this version, if I have devtools open on a reasonably dynamic web app Chrome will crash within a minute or two

kittbuilds - an hour ago

[dead]

idoxer - 3 hours ago

[dead]

fulafel - 2 hours ago

Isn't this a wrongly editorialized title - "Reported by Shaheen Fazim on 2026-02-11" so more like 7-day.

baq - 2 hours ago

I wonder if this was found with LLM assistance, if yes, with which one and is it a one-off or does it mark a start of a new era (I assume it does).