Description
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-02-13
Score: 8.8 High
EPSS: 55.1% High
KEV: Yes
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free vulnerability exists in the CSS parser of Google Chrome prior to version 145.0.7632.75. This is a CWE‑416: Use After Free flaw. The vulnerability occurs when the browser releases memory that is later accessed while parsing CSS, allowing an attacker to execute arbitrary code in the sandboxed browser process. The execution is confined to the sandbox; launching attacks beyond the sandbox requires additional weaknesses.

Affected Systems

Google Chrome installations running any version earlier than 145.0.7632.75 are affected. Based on the known CPEs, it is inferred that this includes Microsoft Windows, macOS, and Linux platforms. Users who load malicious web pages rendered by those browsers are at risk.

Risk and Exploitability

The CVSS score of 8.8 classifies the flaw as high severity, and its EPSS score of 55 % indicates a high likelihood of exploitation. The vulnerability is listed in the CISA KEV catalog, confirming that attacks have been observed. Based on the description, the likely attack vector is remote via a crafted HTML page that triggers the CSS parser. Because the code runs inside the Chrome sandbox, the impact is limited to the browser process itself, but it can affect the confidentiality and integrity of data processed by the browser.

Generated by OpenCVE AI on September 26, 2026 at 11:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome to version 145.0.7632.75 or later to eliminate the memory‑corruption vulnerability (CWE‑416).
  • Ensure Chrome’s built‑in sandbox remains enabled; for custom builds enable it with the '--enable-sandbox' flag, which mitigates the use‑after‑free flaw (CWE‑416) by restricting compromised process privileges.
  • Apply a content‑security policy that restricts CSS loading or blocks inline styles from untrusted origins, helping to prevent malicious content from triggering the CSS parser flaw (CWE‑416).

Generated by OpenCVE AI on September 26, 2026 at 11:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6135-1 chromium security update
History

Fri, 20 Feb 2026 21:30:00 +0000

Type Values Removed Values Added
References

Tue, 17 Feb 2026 21:15:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 17 Feb 2026 20:45:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-02-17T00:00:00+00:00', 'dueDate': '2026-03-10T00:00:00+00:00'}

Tue, 17 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Sat, 14 Feb 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Use after free in CSS
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 13 Feb 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 13 Feb 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 13 Feb 2026 18:45:00 +0000

Type Values Removed Values Added
Description Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-21T12:58:04.180Z

Reserved: 2026-02-13T00:00:18.713Z

Link: CVE-2026-2441

cve-icon Vulnrichment

Updated: 2026-02-13T19:05:03.744Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-13T19:17:31.310

Modified: 2026-06-17T10:30:57.667

Link: CVE-2026-2441

cve-icon Redhat

Severity : Important

Publid Date: 2026-02-13T00:00:00Z

Links: CVE-2026-2441 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T11:15:11Z

Weaknesses