Report · SecurityWeekAbout CVE-2026-2441Published 16 Feb 2026

Google Patches First Actively Exploited Chrome Zero-Day of 2026

Source SecurityWeek

Authoritative record:CVE-2026-2441· High 8.8

Exploited in the wild · KEV due 10 Mar 2026 · public exploit available (Exploit-DB) : upgrade to 145.0.7632.75 now.

Data as of 26 Oct 2026, 08:30 UTC

CVSS 3.1 base score

8.8High

How severe the flaw is on the 0–10 CVSS scale.

KEV deadline: 10 Mar 2026 US federal agencies must patch by this date; a sensible deadline for everyone else.
Patch: Available – fixed in 145.0.7632.75

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 13 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: evidence found.
1 Exploit-DB entry, 76 days after disclosure
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 4 days after disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE ID reserved
by Chrome
13 Feb 202600:00 UTC, 18 hours before disclosure
CVE published
on cve.org
13 Feb 202618:27 UTC, t = 0
In Threat Radar
record ingested
13 Feb 202618:49 UTC, 22 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed
17 Feb 2026, 4 days after disclosure
KEV remediation due
US federal deadline
10 Mar 2026, 25 days after disclosure
First Exploit-DB entry (opens in a new tab)
Google Chrome 145.0.7632.75 - CSSFontFeatureValuesMap
30 Apr 2026, 76 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Chrome to 145.0.7632.75.

Affected software

Product	Affected	Fixed in
GoogleChrome	Affected >=145.0.7632.75 <145.0.7632.75	Fixed in 145.0.7632.75

AI-suggested

Organizations should immediately update all instances of Google Chrome to version 145 or later, ensuring the patch for CVE-2026-2441 is applied. Employ centralized patch management systems to enforce timely updates across all endpoints. Implement web filtering and intrusion prevention systems to block access to known malicious sites and detect exploit attempts. Educate users about the risks of visiting untrusted websites and the importance of applying browser updates promptly. Monitor network and endpoint logs for unusual behavior indicative of exploitation attempts, such as unexpected process launches or anomalous network connections. Consider deploying endpoint detection and response (EDR) solutions capable of identifying exploitation techniques related to browser vulnerabilities. Restrict browser privileges where possible, such as running Chrome with limited user rights, to reduce the impact of a successful exploit. Maintain regular backups and incident response plans to quickly recover from potential compromises. Finally, stay informed through threat intelligence feeds for any emerging exploit activity related to this vulnerability.

Description

A Chrome 145 update fixes CVE-2026-2441, a vulnerability that can likely be exploited for arbitrary code execution. The post Google Patches First Actively Exploited Chrome Zero-Day of 2026 appeared first on SecurityWeek .

Impact

For European organizations, this vulnerability poses a significant risk due to the widespread use of Google Chrome as a primary web browser. Exploitation could lead to unauthorized access to sensitive corporate data, disruption of business operations through system compromise or denial of service, and potential lateral movement within networks if attackers gain footholds via compromised endpoints. Sectors such as finance, healthcare, government, and critical infrastructure are particularly vulnerable due to the sensitivity of their data and the critical nature of their services. The medium severity rating suggests that while the threat is serious, it may not be trivially exploitable at scale without user interaction. However, the potential for arbitrary code execution means that successful exploitation could have severe consequences, including data breaches and operational disruptions. European organizations with remote or hybrid workforces relying heavily on web applications are at increased risk. Failure to patch promptly could result in targeted attacks leveraging this zero-day, especially as threat actors often prioritize widely used software like Chrome.

References

securityweek.com/google-patches-first-actively-exploited-chrome-zero-day-of-2026/ (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Affected software

Description

AI analysisMachine-generated, updated 16 Feb 2026, 08:03 UTC

Public exploits and detection1 Exploit-DB entry

References

Community reviews