Chrome CSS zero-day CVE-2026-2441 exploited in the wild

Sun, 12 Jul 2026 11:56:34 +0000

Engineer — Act: KEV-listed zero-day actively exploited in Chrome’s CSS engine; update Chrome/Chromium to the patched stable release immediately and verify managed browsers in your fleet are on the latest version.
SOC/IR — Act: Active in-the-wild exploitation means assume-breach posture for any endpoint running unpatched Chrome; hunt for suspicious child processes or unusual network connections from Chrome since the February 2026 stable release date, and check EDR telemetry for exploitation indicators.
Leader — Plan: CISA KEV listing confirms active exploitation of a Chrome browser zero-day; validate that your IT/engineering teams have a forced browser-update mechanism and confirm rollout completion — this is routine but warrants a status check given KEV designation.
Signals: CVE-2026-2441 — CISA KEV: listed, EPSS 0.22, public PoC on GitHub

Browser-Security on CuraSec