Chrome 0-Day Enables Remote Code Execution in Ongoing Campaign

Google has released an urgent security update for the Chrome desktop web browser to address a severe high-severity vulnerability that is currently being exploited in the wild.

The search giant rolled out the fix on Friday, updating the Stable channel to version 145.0.7632.75/.76 for Windows and macOS users, and version 144.0.7559.75 for Linux users.

This release specifically targets a zero-day flaw that allows threat actors to compromise systems through memory corruption, making immediate patching critical for all desktop users.

Chrome 0-Day

The vulnerability, tracked as CVE-2026-2441, is described as a “Use After Free” weakness residing in the CSS (Cascading Style Sheets) component of the browser.

This type of vulnerability typically occurs when a program continues to use a pointer to memory after it has been freed, which can cause the program to crash or allow an attacker to execute arbitrary code.

Security researcher Shaheen Fazim is credited with reporting this flaw on February 11, 2026, just two days prior to the patch release, indicating a rapid response from the Chrome security team.

Google has officially confirmed awareness that an exploit for CVE-2026-2441 exists in the wild.

While the company has restricted access to specific bug details until a majority of users have updated, “Use After Free” flaws in browser engines are a common vector for remote code execution attacks.

In a typical attack scenario, a threat actor could craft a malicious webpage that triggers the memory error when rendered by the victim’s browser, potentially allowing the attacker to escape the browser sandbox and run commands on the underlying operating system.

Vulnerability Details

CVE ID	Severity	Description	Reported By
CVE-2026-2441	High	Use after free in CSS component enabling potential code execution	Shaheen Fazim

The update is currently rolling out to the global user base and will become available automatically over the coming days and weeks.

However, given the active exploitation status of this vulnerability, manual verification is strongly recommended.

Users can trigger the update process immediately by navigating to the Chrome menu, selecting “Help,” and clicking “About Google Chrome.”

This action forces the browser to check for the latest version and download the necessary security patches.

This update includes a total of one security fix, highlighting the singular focus on resolving this active threat.

Google has also expressed gratitude to the security researchers who worked during the development cycle to prevent bugs from reaching the stable channel.

Administrators managing enterprise environments should prioritize this deployment to prevent potential intrusions via the CSS rendering engine.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google