Google Chrome zero-day CVE-2026-2441 exploited in wild

18 February 2026 high vulnerability

A use-after-free vulnerability in Chrome's CSS implementation is being actively exploited; Google has released patches for Windows, Mac, and Linux.

Google has disclosed CVE-2026-2441, a use-after-free vulnerability in Chrome's CSS rendering engine that allows arbitrary code execution. Google confirms that exploits exist in the wild and are being actively used against Chrome users. Successful exploitation enables attackers to execute code in the context of the logged-on user, potentially leading to full system compromise depending on privilege levels.

The vulnerability affects Chrome versions prior to 145.0.7632.75/76 on Windows and Mac, and prior to 144.0.7559.75 on Linux. Google has released patches for all affected platforms. The vulnerability is associated with the drive-by compromise technique, where users can be exploited simply by visiting a malicious website.

Organizations should prioritize immediate patching of Chrome browsers across their enterprise. Users with administrative privileges face higher risk, as successful exploitation could allow attackers to install programs, modify or delete data, and create new accounts. Implementing least-privilege access controls and browser isolation can reduce the potential impact of exploitation.

Mentioned in this report

Vulnerabilities CVE-2026-2441KEV

Detection guidance

Suspicious Child Process Spawned by Chrome Browser (Possible Exploitation)

ATT&CK T1189

Detects Chrome or its renderer/GPU helper processes spawning command interpreters or living-off-the-land binaries, consistent with post-exploitation of a browser RCE such as CVE-2026-2441 Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process Spawned by Chrome Browser
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \chrome.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \wscript.exe
    - \cscript.exe
    - \certutil.exe
    - \bitsadmin.exe
  filter_chrome_updater:
    CommandLine|contains:
    - chrome_installer
    - --type=crashpad-handler
    - GoogleUpdate
  condition: selection_parent and selection_child and not filter_chrome_updater
  falsepositives:
  - Chrome auto-update or crash reporting invoking helper executables
  - Enterprise browser management tools that legitimately shell out from chrome.exe
  level: high
  tags:
  - attack.t1189
  - attack.execution
id: c715ecd0-a3e9-59a8-9ba0-bd24bd306f90
status: experimental
author: Vorant

Chrome Renderer Process Writing Executable or Script to Disk

ATT&CK T1189

Detects Chrome renderer or GPU sandbox processes creating executable, script, or DLL files outside expected browser download/cache paths, indicative of sandbox escape following browser exploitation Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Chrome Process Creates Executable or Script File Outside Normal Paths
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith: \chrome.exe
  selection_target:
    TargetFilename|endswith:
    - .exe
    - .dll
    - .ps1
    - .hta
    - .vbs
    - .js
  filter_downloads:
    TargetFilename|contains:
    - \Downloads\
    - \AppData\Local\Google\Chrome\User Data\
    - \Temp\scoped_dir
  condition: selection_image and selection_target and not filter_downloads
  falsepositives:
  - Legitimate file downloads saved by the user through Chrome
  - Chrome extension or component updates writing DLLs to its own profile directories
  level: medium
  tags:
  - attack.t1189
  - attack.defense-evasion
id: 82cba03e-5b58-5fa0-9f84-306c51663613
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-014

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free