Google Chrome zero-day CVE-2026-2441 exploited in wild
A use-after-free vulnerability in Chrome's CSS implementation is being actively exploited; Google has released patches for Windows, Mac, and Linux.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-2441 as exploited in the wild.
Google has disclosed CVE-2026-2441, a use-after-free vulnerability in Chrome's CSS rendering engine that allows arbitrary code execution. Google confirms that exploits exist in the wild and are being actively used against Chrome users. Successful exploitation enables attackers to execute code in the context of the logged-on user, potentially leading to full system compromise depending on privilege levels.
The vulnerability affects Chrome versions prior to 145.0.7632.75/76 on Windows and Mac, and prior to 144.0.7559.75 on Linux. Google has released patches for all affected platforms. The vulnerability is associated with the drive-by compromise technique, where users can be exploited simply by visiting a malicious website.
Organizations should prioritize immediate patching of Chrome browsers across their enterprise. Users with administrative privileges face higher risk, as successful exploitation could allow attackers to install programs, modify or delete data, and create new accounts. Implementing least-privilege access controls and browser isolation can reduce the potential impact of exploitation.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Chrome Browser (Possible Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Chrome or its renderer/GPU helper processes spawning command interpreters or living-off-the-land binaries, consistent with post-exploitation of a browser RCE such as CVE-2026-2441 Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Chrome Browser
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \chrome.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \wscript.exe
- \cscript.exe
- \certutil.exe
- \bitsadmin.exe
filter_chrome_updater:
CommandLine|contains:
- chrome_installer
- --type=crashpad-handler
- GoogleUpdate
condition: selection_parent and selection_child and not filter_chrome_updater
id: c715ecd0-a3e9-59a8-9ba0-bd24bd306f90
status: experimental
author: Vorant
level: high
tags:
- attack.t1189
- attack.execution
falsepositives:
- Chrome auto-update or crash reporting invoking helper executables
- Enterprise browser management tools that legitimately shell out from chrome.exe
Chrome Renderer Process Writing Executable or Script to Disk
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Chrome renderer or GPU sandbox processes creating executable, script, or DLL files outside expected browser download/cache paths, indicative of sandbox escape following browser exploitation Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Process Creates Executable or Script File Outside Normal Paths
logsource:
category: file_event
product: windows
detection:
selection_image:
Image|endswith: \chrome.exe
selection_target:
TargetFilename|endswith:
- .exe
- .dll
- .ps1
- .hta
- .vbs
- .js
filter_downloads:
TargetFilename|contains:
- \Downloads\
- \AppData\Local\Google\Chrome\User Data\
- \Temp\scoped_dir
condition: selection_image and selection_target and not filter_downloads
id: 82cba03e-5b58-5fa0-9f84-306c51663613
status: experimental
author: Vorant
level: medium
tags:
- attack.t1189
falsepositives:
- Legitimate file downloads saved by the user through Chrome
- Chrome extension or component updates writing DLLs to its own profile directories
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-014
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs