Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero-day CSS: CVE-2026-2441 exists in the wild

chromereleases.googleblog.com

Post reply on HN
Print view View original

61–70 of 242 posts

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#61

Post by masklinn »

staticassertion wrote: post #23
himata4113 wrote: post #12

The fact that these still show up is pretty wild to me. Don't we have a bunch of tools that should create memory-safish binaries by applying the same validation checks that memory-safe languages get for free purely from their design? I get that css has changed a lot over the years with variables, scopes and adopting things from less/sass/coffee, but people use no-script for the reason because javascript is risky, but…

> Don't we have a bunch of tools that should create memory-safish binaries by applying the same validation checks that memory-safe languages get for free purely from their design? No, we don't. All of the ones we have are heavily leveraged in Chromium or were outright developed at Google for similar projects. 10s of billions are spent to try to get Chromium to not have these vulnerabilities, using those tools. And he…

> Things like sanitizers largely rely on test coverage.

And not in a trivial “this line is traversed” way, you need to actually trigger the error condition at runtime for a sanitizer to see anything. Which is why I always shake my head at claims that go has “amazing thread safety” because it has the race detector (aka tsan). That’s the opposite of thread safety. It is, if anything, an admission to a lack of it.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#62

Post by IggleSniggle »

kspacewalk2 wrote: post #50
arcfour wrote: post #42

Earlier quoted context omitted.

Because it's nice to get $10k legally + public credit than it is to get $100k while risking arrest + prison time, getting scammed, or selling your exploit to someone that uses it to ransom a children's hospital?

Is it in fact illegal to sell a zero day exploit of an open source application or library to whoever I want?

Depends. Within the US, there are data export laws that could make the "whoever" part illegal. There are also conspiracy to commit a crime laws that could imply liability. There are also laws that could make performing/demonstrating certain exploits illegal, even if divulging it isn't. That could result in some legal gray area. IANAL but have worked in this domain. Obviously different jurisdictions may handle such issues differently from one another.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#63

Post by bawolff »

zozbot234 wrote: post #43
bicepjai wrote: post #9

Earlier quoted context omitted.

So basically Firefox is not affected ?

Firefox is safe from this because their CSS handling was the first thing they rewrote in Rust.

I mean, even if it was written in c or c++, its unlikely two separate code bases would have the exact same use after feee vuln.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#64

Post by deanc »

mpeg wrote: post #5

"Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera." That's pretty bad! I wonder what kind of bounty went to the researcher.

Presumably this affects all electron apps which embed chrome too? Don’t they pin the chrome version?

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#65

Post by comex »

deanc wrote: post #64
mpeg wrote: post #5

"Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera." That's pretty bad! I wonder what kind of bounty went to the researcher.

Presumably this affects all electron apps which embed chrome too? Don’t they pin the chrome version?

Yes, but it's only a vulnerability if the app allows rendering untrusted HTML or visiting untrusted websites, which most Electron apps don't.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#66

Post by bawolff »

maxloh wrote: post #33
tripplyons wrote: post #4

"Use after free in CSS" is a funny description to see.

I think they meant something like the CSS parser, or the CSS Object Model (CSSOM).

One of the other commenters wrote a post that said it was related to @font-feature-values

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#67

Post by bawolff »

Aachen wrote: post #15
fulafel wrote: post #14

Isn't this a wrongly editorialized title - "Reported by Shaheen Fazim on 2026-02-11" so more like 7-day.

It refers to your many days software is available for, with zero implying it is not yet out so you couldn't have installed a new version and that's what makes it a risky bug The term has long watered-down to mean any vulnerability (since it was always a zero-day at some point before the patch release, I guess is those people's logic? idk). Fear inflation and shoehorning seems to happen to any type of scary/scarier/sc…

I think the implication in this specific context is that malicious people were exploiting the vuln in the wild prior to the fix being released

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#68

Post by josefx »

staticassertion wrote: post #23
himata4113 wrote: post #12

The fact that these still show up is pretty wild to me. Don't we have a bunch of tools that should create memory-safish binaries by applying the same validation checks that memory-safe languages get for free purely from their design? I get that css has changed a lot over the years with variables, scopes and adopting things from less/sass/coffee, but people use no-script for the reason because javascript is risky, but…

> Don't we have a bunch of tools that should create memory-safish binaries by applying the same validation checks that memory-safe languages get for free purely from their design? No, we don't. All of the ones we have are heavily leveraged in Chromium or were outright developed at Google for similar projects. 10s of billions are spent to try to get Chromium to not have these vulnerabilities, using those tools. And he…

I heard they once created an entire language that would replace C++ in all their projects. Obviously they never rewrote Chrome in Go.

> 10s of billions are spent to try to get Chromium to not have these vulnerabilities, using those tools. And here we are.

Shouldn't pages run in isolated and sandboxed processes anyway? If that exploit gets you anywhere it would be a failure of multiple layers.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#69

Post by stackghost »

JoeAltmaier wrote: post #30
kibwen wrote: post #25

Earlier quoted context omitted.

But this is irrelevant. If you're afraid of third-party code, you can just... choose not to use third-party code? Meanwhile, if I'm afraid of memory corruption in C, I cannot just choose not to have memory corruption; I must instead simply choose not to use C. Meanwhile, Chromium uses tons of third-party Rust code, and has thereby judged the risk differently.

Maybe it's more complicated than that? With allocate/delete discipline, C can be fairly safe memory-wise (written a million lines of code in C). But automated package managers etc can bring in code under the covers, and you end up with something you didn't ask for. By that point of view, we reverse the conclusion.

>With allocate/delete discipline, C can be fairly safe memory-wise (written a million lines of code in C)

The last 40-50 years have conclusively shown us that relying on the programmer to be disciplined, yourself included, does not work.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#70

Post by throwaway150 »

duozerk wrote: post #38
naeioi wrote: post #29

Earlier quoted context omitted.

The bounty could be very high. Last year one bug’s reporter was rewarded $250k. https://news.ycombinator.com/item?id=44861106

Maybe google is an exception (but then again, maybe that payout was part marketing to draw more researchers).

So is there anything that would actually satisfy crowd here?

Offer $25K and it is "How dare a trillion dollar company pay so little?"

Offer $250K and it is "Hmm. Exception! Must be marketing!"

What precisely is an acceptable number?

Post reply on HN