Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since yesterday.

Exploitation active

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Apple
  • Macos
Google
  • Chrome
Linux
  • Linux Kernel
Microsoft
  • Windows

Configuration 1 [-]

AND
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
OR cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

No data.

References
Link Providers
https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html cve-icon cve-icon cve-icon
https://issues.chromium.org/issues/483569511 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-2441 cve-icon
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-2441 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-2441 cve-icon
History

Tue, 17 Feb 2026 21:15:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 17 Feb 2026 20:45:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-02-17T00:00:00+00:00', 'dueDate': '2026-03-10T00:00:00+00:00'}

Tue, 17 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Sat, 14 Feb 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Use after free in CSS
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 13 Feb 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 13 Feb 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 13 Feb 2026 18:45:00 +0000

Type Values Removed Values Added
Description Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2026-02-13T18:27:48.355Z

Updated: 2026-02-17T23:20:24.858Z

Reserved: 2026-02-13T00:00:18.713Z

Link: CVE-2026-2441

cve-icon Vulnrichment

Updated: 2026-02-13T19:05:03.744Z

cve-icon NVD

Status : Modified

Published: 2026-02-13T19:17:31.310

Modified: 2026-02-17T21:22:16.427

Link: CVE-2026-2441

cve-icon Redhat

Severity : Important

Publid Date: 2026-02-13T00:00:00Z

Links: CVE-2026-2441 - Bugzilla