By Sergiu Gatlan
Publication Date: 2026-02-16 08:19:00
Google has released emergency updates to fix a high-severity Chrome vulnerability exploited in zero-day attacks, marking the first such security flaw patched since the start of the year.
“Google is aware that an exploit for CVE-2026-2441 exists in the wild,” Google said in a security advisory issued on Friday.
According to the Chromium commit history, this use-after-free vulnerability (reported by security researcher Shaheen Fazim) is due to an iterator invalidation bug in CSSFontFeatureValuesMap, Chrome’s implementation of CSS font feature values. Successful exploitation can allow attackers to trigger browser crashes, rendering issues, data corruption, or other undefined behavior.
The commit message also notes that the CVE-2026-2441 patch addresses “the immediate problem” but indicates there’s “remaining work” tracked in bug 483936078, suggesting this might be a temporary fix or that related issues still need to be addressed.
The patch was tagged as…
