Google Patches Actively Exploited Chrome Zero-Day Flaw

Google has released an emergency security patch for a high-severity zero-day vulnerability in its Chrome browser that attackers are actively exploiting. The flaw, identified as CVE-2026-2441, affects the browser's CSS component and was reported on February 11, 2026, by security researcher Shaheen Fazim. This marks the first such zero-day patched by the company this year, impacting users on Windows, macOS, and Linux systems.

The vulnerability is a use-after-free error in Chrome's handling of CSS font features, specifically the CSSFontFeatureValuesMap. According to Google's advisory, it stems from an iterator invalidation bug that occurs when the browser processes certain font data, allowing a remote attacker to execute arbitrary code inside the browser's sandbox through a crafted HTML page. The sandbox is designed to isolate web content and limit potential damage, but exploitation could still enable attackers to access or alter data within a user's browser session, such as stealing login credentials or injecting malicious scripts. Google assigned the issue a severity score of 8.3 out of 10, classifying it as high risk.

Google became aware of the exploit in the wild shortly after...