Google has released an emergency update for Chrome that fixes a zero-day vulnerability already being actively exploited by attackers. If you use Chrome, you need to update right now.
What is CVE-2026-2441 and why is it serious
The vulnerability, identified as CVE-2026-2441, has a CVSS score of 8.8 out of 10 (high severity). It's a "use-after-free" bug in Chrome's CSS engine, meaning an attacker can execute malicious code on your computer simply by getting you to visit a manipulated web page.
In simple terms: a malicious website can hack your browser without you doing anything other than opening it.
How the attack works
The attack works like this:
- An attacker creates a web page with specially crafted HTML/CSS code
- When you visit that page with a vulnerable Chrome, the CSS engine frees memory that's still in use
- The attacker exploits that freed memory to execute their own code
- Although the code runs inside Chrome's sandbox, it can be combined with other vulnerabilities to escape
Google confirmed that "an exploit for CVE-2026-2441 exists in the wild", meaning attackers are already using it against real users.
Who discovered the vulnerability
Security researcher Shaheen Fazim reported the vulnerability to Google on February 11, 2026. Google released the patch just 2 days later on February 13, showing the severity of the issue.
How to update Chrome now
Follow these steps to protect yourself:
- Open Chrome and go to
chrome://settings/help - Chrome will automatically search for updates
- Install the update to version 145.0.7632.75 or higher
- Restart Chrome — the update doesn't apply until you close and reopen the browser
If you use Linux, the patched version is 144.0.7559.75.
What to do if you can't update immediately
- Avoid visiting unknown websites until you update
- Don't click suspicious links in emails or messages
- Use another browser temporarily if you can't update Chrome right away
- Enable Safe Browsing in Chrome: Settings > Privacy and security > Security > Enhanced protection
Context: Chrome and zero-days
This is the first actively exploited zero-day that Google has patched in Chrome in 2026. In 2025, Google patched a total of 9 zero-days in Chrome. With over 3 billion users, Chrome is the most attractive target for attackers, and zero-day vulnerabilities are the most dangerous because they're exploited before a patch exists.
Update Chrome now. Don't wait until tomorrow.
