Google rushes Chrome fix as attackers exploit CSS zero-day in the wild

Google has pushed out an emergency security update for Chrome after discovering that attackers were actively exploiting a zero-day vulnerability in the browser's CSS handling engine. The flaw, designated CVE-2026-2441 with a CVSS score of 8.8, represents the first reported zero-day of 2026 and highlights the ongoing security challenges facing one of the world's most widely used web browsers.

The vulnerability and its impact

The vulnerability stems from a use-after-free bug in Chrome's CSS processing system. This type of flaw occurs when a program continues to use a memory location after it has been freed, potentially allowing attackers to execute arbitrary code. In this case, the bug could be triggered by a specially crafted HTML page, meaning that simply visiting a malicious website could be enough for an attacker to run code inside the browser's sandbox environment.

While the sandbox provides some protection by isolating browser processes from the rest of the system, the fact that this vulnerability was being exploited in the wild prompted Google to act quickly. The company released Chrome version 145.0.7632.75 for Windows and Mac, and 144.0.7559.75 for Linux, with the updates rolling out to users over the coming days and weeks.

Timeline of discovery and response

Security researcher Shaheen Fazim reported the flaw to Google on February 11, 2026. Remarkably, just two days later on February 13, Google confirmed that the vulnerability was already being exploited in real-world attacks. This rapid progression from discovery to exploitation underscores the persistent threat posed by zero-day vulnerabilities in widely deployed software.

Google's security team has been deliberately vague about the specifics of the attacks, including whether they were targeted operations or part of broader campaigns. This lack of detail is standard practice when dealing with active exploitation, as revealing too much information could help other attackers weaponize the same vulnerability before users have a chance to update.

Context: Chrome's ongoing security challenges

This zero-day fix is part of a larger pattern for Google's browser division. In 2025 alone, the company patched eight different zero-day vulnerabilities that were being actively exploited. The frequency of these discoveries highlights both the complexity of modern web browsers and the persistent efforts of attackers to find and exploit security flaws.

The timing of this fix is particularly notable as it comes shortly after revelations about Chrome extensions engaging in data theft on a massive scale. Researchers recently discovered that at least 287 Chrome extensions, collectively installed tens of millions of times, were quietly harvesting users' browsing histories and selling the data to third parties. This dual threat—from both browser vulnerabilities and the extension ecosystem—demonstrates the multiple attack vectors that users face when browsing the web.

Broader implications for web security

This incident serves as a reminder of the delicate balance between browser functionality and security. CSS, the technology at the heart of this vulnerability, is fundamental to modern web design and user experience. The fact that a core styling technology can be weaponized to execute code illustrates the inherent complexity and potential security risks in web technologies.

For users, the immediate takeaway is clear: update Chrome as soon as the new version becomes available. For organizations managing Chrome deployments across multiple devices, this incident underscores the importance of having robust patch management processes in place to ensure timely updates.

The extension ecosystem: An additional attack surface

The recent discovery of data-harvesting Chrome extensions adds another layer to the security landscape. While Google has taken steps to remove the offending extensions and improve its review processes, the incident reveals how browser extensions can serve as a backdoor for data collection and potentially other malicious activities.

This ecosystem of third-party add-ons represents a significant attack surface that extends beyond the core browser code. Users who install extensions grant them varying levels of access to their browsing data and activities, creating opportunities for abuse even when the browser itself remains secure.

Looking ahead

As web browsers continue to evolve with new features and capabilities, the security challenges will likely persist. The race between vulnerability discovery and patch deployment remains a central dynamic in software security, with zero-days representing the most urgent category of threats.

For Google, maintaining Chrome's security while preserving its speed and functionality remains a critical priority. The company's rapid response to this zero-day demonstrates its commitment to addressing threats quickly, but the recurring nature of these incidents suggests that the underlying challenges of securing a complex, widely-used piece of software remain significant.

The incident also highlights the importance of responsible disclosure practices, where security researchers work with vendors to address vulnerabilities before they can be widely exploited. In this case, the quick reporting by Shaheen Fazim likely prevented more widespread damage, though the fact that exploitation was already occurring when the report was made shows how quickly these situations can escalate.

As users await the rollout of the security update, the episode serves as a stark reminder of the constant vigilance required in the digital age, where a single visit to the wrong webpage could potentially compromise a system's security.