CVE-2026-2441

HIGH KEV

Google Chrome <145.0.7632.75 - Use After Free

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2026-2441 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 17, 2026. EIP tracks 17 public exploits from researchers including nu11secur1ty, Unclecheng-li, huseyinstif.

AI-analyzed exploit summary The provided code is a functional proof-of-concept exploit for CVE-2026-2441, a use-after-free vulnerability in Google Chrome's CSS engine (Blink) within the CSSFontFeatureValuesMap implementation. It demonstrates the vulnerability by creating an iterator over a CSSFontFeatureValuesMap object and mutating the underlying HashMap during iteration, leading to a use-after-free condition.

Description

Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Exploits (17)

exploitdb WORKING POC
by nu11secur1ty · textlocalmultiple
https://www.exploit-db.com/exploits/52542

The provided code is a functional proof-of-concept exploit for CVE-2026-2441, a use-after-free vulnerability in Google Chrome's CSS engine (Blink) within the CSSFontFeatureValuesMap implementation. It demonstrates the vulnerability by creating an iterator over a CSSFontFeatureValuesMap object and mutating the underlying HashMap during iteration, leading to a use-after-free condition.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Google Chrome <= 144.x, Google Chrome < 145.0.7632.75, Microsoft Edge (prior to Chromium 145 update), Opera (prior to 127.0.5778.64)
No auth needed
Prerequisites: Browser with vulnerable version of Chrome/Chromium
devstral-2 · analyzed May 05, 2026 Full analysis →
github WORKING POC 161 stars
by Unclecheng-li · cpoc
https://github.com/Unclecheng-li/poc-lab/tree/main/CVE-2026-2441 Chrome CSSFontFeatureValuesMap UAF

This repository contains a functional exploit PoC for CVE-2026-2441, a Use-After-Free (UAF) vulnerability in Chrome's CSSFontFeatureValuesMap iterator. The exploit demonstrates the vulnerability by triggering a UAF through iterator invalidation during HashMap rehashing.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Google Chrome < 145.0.7632.75
No auth needed
Prerequisites: User must visit a malicious HTML page
devstral-2 · analyzed May 22, 2026 Full analysis →
github WRITEUP 12 stars
by huseyinstif · htmlpoc
https://github.com/huseyinstif/CVE-2026-2441-PoC

This repository provides a detailed technical analysis of CVE-2026-2441, a use-after-free vulnerability in Chrome's Blink CSS engine, including root cause, patch details, and proof-of-concept methods.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Google Chrome < 145.0.7632.75
No auth needed
Prerequisites: Vulnerable Chrome version · User visits malicious webpage
devstral-2 · analyzed Feb 18, 2026 Full analysis →
github SUSPICIOUS 10 stars
by XiaomingX · pythonpoc
https://github.com/XiaomingX/data-cve-poc-py-v1/tree/main/2026/CVE-2026-2441

The repository claims to provide a PoC for a Chrome CSS Use-After-Free vulnerability but lacks actual exploit code, instead directing users to an external download link. The description includes technical details but is likely a lure to trick researchers into downloading potentially malicious content.

Classification
Suspicious 90%
Attack Type
Rce
Complexity
Complex
Reliability
Theoretical
Target: Google Chrome <=144.0.x
No auth needed
Prerequisites: Hosting the provided HTML file and visiting it in a vulnerable Chrome version
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec SUSPICIOUS 3 stars
by b1gchoi · poc
https://github.com/b1gchoi/CVE-2026-2441_POC

The repository claims to be a PoC for a Chrome CSS Use-After-Free vulnerability but lacks actual exploit code, instead redirecting users to an external download link. The description includes technical details but no verifiable code or analysis.

Classification
Suspicious 90%
Attack Type
Rce
Complexity
Complex
Reliability
Theoretical
Target: Chrome <=144.0.x
No auth needed
Prerequisites: Victim must visit a malicious webpage hosting the exploit
devstral-2 · analyzed Feb 18, 2026 Full analysis →
github WORKING POC
by MillerDetach · pythonpoc
https://github.com/MillerDetach/poc-lab-pro/tree/main/CVE-2026-2441 Chrome CSSFontFeatureValuesMap UAF

This repository contains a functional exploit PoC for CVE-2026-2441, a Use-After-Free (UAF) vulnerability in Chrome's CSSFontFeatureValuesMap iterator. The exploit demonstrates the vulnerability by triggering a UAF through iterator invalidation during HashMap rehashing.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Google Chrome < 145.0.7632.75
No auth needed
Prerequisites: User must visit a malicious HTML page
devstral-2 · analyzed Jun 09, 2026 Full analysis →
github WORKING POC
by SmashMythAmp · pythonpoc
https://github.com/SmashMythAmp/poc-lab-605/tree/main/CVE-2026-2441 Chrome CSSFontFeatureValuesMap UAF

This repository contains a functional exploit PoC for CVE-2026-2441, a Use-After-Free (UAF) vulnerability in Chrome's CSSFontFeatureValuesMap iterator. The exploit demonstrates the vulnerability by triggering a UAF through iterator invalidation during HashMap rehashing.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Google Chrome < 145.0.7632.75
No auth needed
Prerequisites: User must visit a malicious HTML page
devstral-2 · analyzed Jun 06, 2026 Full analysis →
github WORKING POC
by LadyAqueduct · htmlpoc
https://github.com/LadyAqueduct/poc-lab-798/tree/main/CVE-2026-2441 Chrome CSSFontFeatureValuesMap UAF

This repository contains a functional exploit PoC for CVE-2026-2441, a Use-After-Free (UAF) vulnerability in Chrome's CSSFontFeatureValuesMap iterator. The exploit demonstrates the vulnerability by triggering a UAF through iterator invalidation during HashMap rehashing.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Google Chrome < 145.0.7632.75
No auth needed
Prerequisites: Chrome browser with version < 145.0.7632.75
devstral-2 · analyzed Jun 06, 2026 Full analysis →
github WORKING POC
by XZ1r0 · pythonpoc
https://github.com/XZ1r0/cve-2026-poc-collection/tree/main/other/CVE-2026-2441-PoC

This repository contains a functional proof-of-concept exploit for CVE-2026-2441, a use-after-free vulnerability in Chrome's Blink CSS engine. The PoC demonstrates the UAF by triggering iterator invalidation in CSSFontFeatureValuesMap through multiple methods, including direct iteration, for...of loops, and requestAnimationFrame-based triggers.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Google Chrome <= 144.0.x (all versions prior to 145.0.7632.75)
No auth needed
Prerequisites: Vulnerable Chrome version (< 145.0.7632.75) · User visits malicious webpage
devstral-2 · analyzed May 21, 2026 Full analysis →
nomisec WORKING POC
by MartinaStarone · poc
https://github.com/MartinaStarone/CVE-2026-2441

This repository contains a functional proof-of-concept exploit for CVE-2026-2441, a use-after-free vulnerability in Google Chrome's Blink CSS engine. The exploit demonstrates arbitrary code execution within the renderer sandbox via crafted HTML, with detailed technical analysis and multiple trigger methods.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Google Chrome < 145.0.7632.75
No auth needed
Prerequisites: Vulnerable Chrome version · User visits malicious page
devstral-2 · analyzed May 07, 2026 Full analysis →
nomisec SUSPICIOUS
by fartlover37 · poc
https://github.com/fartlover37/CVE-2026-2441-PoC

The repository lacks actual exploit code and instead directs users to download an external executable from GitHub releases, which is a common tactic for distributing malware or fake exploits.

Classification
Suspicious 95%
Attack Type
Other
Complexity
N/a
Reliability
N/a
Target: Google Chrome < 145.0.7632.75
No auth needed
Prerequisites: Windows 10 or higher · Google Chrome < 145.0.7632.75
devstral-2 · analyzed Mar 04, 2026 Full analysis →
nomisec WRITEUP
by D3b0j33t · dos
https://github.com/D3b0j33t/CVE-2026-2441-PoC

This repository provides a detailed technical analysis of CVE-2026-2441, a use-after-free vulnerability in Chrome's Blink CSS engine. It includes root cause analysis, patch details, and a description of the PoC methods but does not contain actual exploit code.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Google Chrome < 145.0.7632.75
No auth needed
Prerequisites: Vulnerable Chrome version · User visits malicious page
devstral-2 · analyzed Mar 02, 2026 Full analysis →
nomisec SUSPICIOUS
by NetVanguard-cmd · poc
https://github.com/NetVanguard-cmd/CVE-2026-2441

The repository claims to provide an exploit for CVE-2026-2441 (a use-after-free in Chrome's CSS engine) but contains no actual exploit code. Instead, it directs users to an external download link (tinyurl.com), which is a common tactic for distributing malware or fake exploits.

Classification
Suspicious 95%
Attack Type
Rce
Complexity
Theoretical
Reliability
Theoretical
Target: Google Chrome before 145.0.7632.75
No auth needed
Prerequisites: crafted HTML page · victim interaction
devstral-2 · analyzed Feb 25, 2026 Full analysis →
nomisec STUB
by atiilla · dos
https://github.com/atiilla/CVE-2026-2441_PoC

The repository contains only a minimal README with no exploit code, technical details, or functional proof-of-concept. It is a placeholder with no substantive content.

Classification
Stub 100%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 23, 2026 Full analysis →
nomisec SUSPICIOUS
by washingtonmaister · poc
https://github.com/washingtonmaister/CVE-2026-2441

The repository claims to provide an exploit for CVE-2026-2441, a use-after-free vulnerability in Google Chrome's CSS handling, but only includes a README with vague details and a link to an external download. No actual exploit code is present.

Classification
Suspicious 90%
Attack Type
Rce
Complexity
Theoretical
Reliability
Theoretical
Target: Google Chrome before 145.0.7632.75
No auth needed
Prerequisites: Crafted HTML page · Victim interaction
devstral-2 · analyzed Feb 21, 2026 Full analysis →
nomisec WRITEUP
by theemperorspath · client-side
https://github.com/theemperorspath/CVE-2026-2441-PoC

The repository describes a Chrome CSS Use-After-Free vulnerability (CVE-2026-2441) in Blink's CSSFontFeatureValuesMap, leading to renderer RCE via iterator invalidation and memory corruption. The PoC involves CSSOM grooming, UAF exploitation, and a chain to achieve arbitrary read/write and shellcode execution.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Chrome <=144.0.x
No auth needed
Prerequisites: Chrome browser <=144.0.x · User interaction to visit a malicious webpage
devstral-2 · analyzed Feb 20, 2026 Full analysis →
nomisec SUSPICIOUS
by jermaine22sei · poc
https://github.com/jermaine22sei/CVE-2026-2441

The repository claims to exploit CVE-2026-2441 (a use-after-free in Chrome's CSS) but provides no actual exploit code, instead redirecting users to an external download link (tinyurl.com). The README lacks technical details and reads like a sales pitch.

Classification
Suspicious 95%
Attack Type
Rce
Complexity
Theoretical
Reliability
Theoretical
Target: Google Chrome < 145.0.7632.75
No auth needed
Prerequisites: none provided
devstral-2 · analyzed Feb 19, 2026 Full analysis →

Scores

CVSS v3 8.8
EPSS 0.2313
EPSS Percentile 96.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2026-02-17
VulnCheck KEV 2026-02-13
ENISA EUVD EUVD-2026-6071
CWE
CWE-416
Status published
Products (1)
google/chrome < 145.0.7632.75
Published Feb 13, 2026
KEV Added Feb 17, 2026
Tracked Since Feb 18, 2026