Zero-day CSS: CVE-2026-2441 exists in the wild

"Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera."

That's pretty bad! I wonder what kind of bounty went to the researcher.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#6

Post by waynesonfire » Wed, Feb 18, 2026, 4:52 PM UTC

mpeg wrote: post #5

"Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera." That's pretty bad! I wonder what kind of bounty went to the researcher.

"Actually, you forgot Brave."

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#7

Post by baq » Wed, Feb 18, 2026, 4:53 PM UTC

I wonder if this was found with LLM assistance, if yes, with which one and is it a one-off or does it mark a start of a new era (I assume it does).

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#8

Post by mpeg » Wed, Feb 18, 2026, 4:54 PM UTC

waynesonfire wrote: post #6

mpeg wrote: post #5

"Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera." That's pretty bad! I wonder what kind of bounty went to the researcher.

"Actually, you forgot Brave."

I quoted directly from NIST, there's many other browsers and non-browsers that use chromium

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#9

Post by bicepjai » Wed, Feb 18, 2026, 4:54 PM UTC

mpeg wrote: post #5

"Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera." That's pretty bad! I wonder what kind of bounty went to the researcher.

So basically Firefox is not affected ?

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#10

Post by jsheard » Wed, Feb 18, 2026, 4:57 PM UTC

bicepjai wrote: post #9

mpeg wrote: post #5

"Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera." That's pretty bad! I wonder what kind of bounty went to the researcher.

So basically Firefox is not affected ?

Firefox and Safari are fine in this case, yeah.