Google patches actively exploited Chrome zero day CVE 2026 2441

A routine browser update just became urgent. Google has patched a high-severity Chrome zero-day vulnerability, tracked as CVE-2026-2441, that is already being exploited in the wild. If you use Chrome on Windows, macOS, or Linux, this is not an update to postpone. The flaw carries a CVSS score of 8.8, placing it firmly in the high-risk category.

What is CVE 2026 2441 and why it matters

CVE-2026-2441 is a use-after-free vulnerability in Chrome’s CSS component. In technical terms, this happens when memory that has already been released is reused by the program. Attackers can manipulate this condition to execute malicious code.

According to the National Vulnerability Database (NVD), the bug allowed a remote attacker to execute arbitrary code inside Chrome’s sandbox via a crafted HTML page in versions prior to 145.0.7632.75.

In plain language: a malicious website could potentially trigger the flaw simply by being opened.

Google confirmed that “an exploit for CVE-2026-2441 exists in the wild,” though it has not disclosed who is behind the attacks or who may have been targeted. That silence is typical during active investigations and helps prevent further weaponization.

Why browsers remain a prime attack surface

From a security standpoint, browsers are one of the most exposed pieces of software on any device. They process untrusted web content continuously. Every script, stylesheet, and image is parsed in real time.

As someone who has tracked browser vulnerabilities for years, a pattern is clear: when a Chrome zero-day is exploited, it often signals targeted campaigns before broader criminal adoption.

CVE-2026-2441 is also the first actively exploited Chrome zero-day patched in 2026. In 2025, Google addressed eight zero-days in Chrome, either under active exploitation or demonstrated as proof of concept. The pace has not slowed.

How to update Chrome immediately

Google has released the following fixed versions:

Windows and macOS: 145.0.7632.75 / 145.0.7632.76

Linux: 144.0.7559.75

To update:

Open Chrome

Go to More > Help > About Google Chrome

Allow the update to download

Click Relaunch

If you use a Chromium-based browser such as Microsoft Edge, Brave, Opera, or Vivaldi, monitor for corresponding updates and install them as soon as available.

The bigger security signal

This patch follows closely after Apple fixed an exploited zero-day in its operating systems last week. The broader message is clear: zero-day exploitation remains active across major platforms in 2026.

For users, the takeaway is simple but critical. Browser updates are no longer routine maintenance. They are frontline security patches. If your Chrome version is outdated, update it now. A two-minute restart could prevent a silent compromise.

More For You

iOS 26.3 Is Here to Stop a Stealthy Zero Day Attack Hitting Apple Devices

What agent-driven AI means for network and security design

AI agent skills are quietly becoming a major security risk

Gemini could soon let users carry chat history across AI platforms