CVE-2026-2441: Google Chromium CSS -- Use-After-Free Heap Corruption

Background

Chromium’s CSS engine is responsible for parsing and applying styling rules to web content. As a complex, performance-critical subsystem that manages the lifecycle of style objects across the document object model, it is a recurring source of memory safety vulnerabilities. CSS processing in browsers involves intricate object graphs with complex ownership semantics, creating opportunities for use-after-free conditions.

CVE-2026-2441 is a use-after-free (CWE-416) in Chromium’s CSS component that can be triggered by visiting a webpage containing crafted HTML and CSS. Successful exploitation leads to heap corruption, which is typically leveraged for arbitrary code execution within the renderer process. All Chromium-based browsers are affected: Google Chrome, Microsoft Edge, Opera, Brave, Vivaldi, and others.

CISA added this to the KEV catalog on 2026-02-17, confirming active exploitation. Browser vulnerabilities in core rendering components are high-priority targets for exploit kit developers and nation-state actors conducting targeted compromise via malicious web pages.

Technical Mechanism

CWE-416 (Use After Free) in Chromium’s CSS engine typically involves the StyleEngine or StyleResolver holding references to style objects after those objects have been garbage-collected or explicitly deleted during style recalculation.

// Conceptual JavaScript trigger for CSS UAF (simplified)
function triggerUAF() {
    const div = document.createElement("div");
    document.body.appendChild(div);
    
    // Apply computed style that creates internal CSS object
    div.style.animation = "complex-animation 1s";
    
    // Force style recalculation that frees the internal object
    document.styleSheets[0].deleteRule(0);
    
    // Trigger second access to freed CSS object via layout
    div.getBoundingClientRect();  // UAF: accesses freed style data
}
triggerUAF();

By triggering the CSS engine to free an object while a reference to it remains in use during a subsequent layout or style operation, the attacker can cause a heap corruption. Through heap shaping and memory grooming, this is typically escalated to a write primitive sufficient for code execution.

Real-World Exploitation Evidence

CISA’s KEV listing confirms active exploitation. CSS use-after-free vulnerabilities in Chromium are a proven attack class — multiple prior Chromium CSS UAF CVEs have been exploited by nation-state actors and commercial surveillance vendors. The vulnerability’s cross-browser impact amplifies the attack surface to essentially all desktop Chrome-based browser users. Exploit chains typically combine renderer UAF with a sandbox escape for full OS-level code execution.

Impact Assessment

• Remote code execution in the Chromium renderer process
• Heap corruption enabling memory read/write primitives
• Cross-browser impact: Chrome, Edge, Opera, Brave, Vivaldi, and other Chromium-based browsers
• When chained with sandbox escape: full user-level OS code execution
• Exploitable via a single malicious webpage visit (drive-by download)

Affected Versions

Remediation Steps

1. Update all Chromium-based browsers to the latest version immediately.
2. Enable automatic browser updates to ensure rapid patching going forward.
3. Consider deploying Site Isolation policies to limit cross-site data access.
4. Use web content filtering to block access to known malicious domains.
5. Enable enhanced safe browsing in Chrome for phishing and malware protection.

Detection Guidance

Log Sources: EDR process telemetry, network proxy/DNS logs.

IOCs: Chrome renderer process crashes followed by unexpected new processes; renderer spawning cmd.exe, PowerShell, or other shells; unusual outbound connections from browser processes.

Sigma rule:

title: Chromium CSS UAF Exploitation Chain CVE-2026-2441
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: '\chrome.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
  condition: selection
level: high

Timeline

References

• NVD — CVE-2026-2441
• CISA KEV — CVE-2026-2441
• Google Security Advisory — CVE-2026-2441