- "Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera."
That's pretty bad! I wonder what kind of bounty went to the researcher.
by cosmic_cheese
2 subcomments
- I wonder how many bugs like this are lurking in the various dark corners of the Chromium/Blink codebase that nobody has taken a good, hard look at in a long time.
Given the staggering importance of the projects they should really have a full-time, well-staffed, well-funded, dedicated team combing through every line, hunting these things down, and fixing them before they have a chance to be used. It'd be a better use of resources than smart fridge integration or whatever other bells and whistles Google has most recently decided to tack onto Chrome.
- I don't quite understand the vulnerability, when exploited, you can get information about the page from which the exploit code is running. Without a sandbox escape or XSS, that seems almost completely harmless?
This is the "impact" section on https://github.com/huseyinstif/CVE-2026-2441-PoC:
Arbitrary code execution within the renderer process sandbox
Information disclosure — leak V8 heap pointers (ASLR bypass), read renderer memory contents
Credential theft — read document.cookie, localStorage, sessionStorage, form input values
Session hijacking — steal session tokens, exfiltrate via fetch() / WebSocket / sendBeacon()
DOM manipulation — inject phishing forms, modify page content
Keylogging — capture all keystrokes via addEventListener('keydown')
by tripplyons
2 subcomments
- "Use after free in CSS" is a funny description to see.
by himata4113
1 subcomments
- The fact that these still show up is pretty wild to me. Don't we have a bunch of tools that should create memory-safish binaries by applying the same validation checks that memory-safe languages get for free purely from their design?
I get that css has changed a lot over the years with variables, scopes and adopting things from less/sass/coffee, but people use no-script for the reason because javascript is risky, but what if css can be just as risky... time to also have no-style?
Honestly, pretty excited for the full report since it's either stupid as hell or a multi-step attack chain.
- I'd love to see what the PoC code looks like, of course after the patch has been rolled out for a few weeks.
by agentifysh
0 subcomment
- this is insane! what other zero days are out there and being used
also this seems chromium only so it doesnt impact firefox ?
- Maybe Chromium should also rewrite their rendering engine in Rust ;p
by MallocVoidstar
1 subcomments
- Devtools is seemingly partially broken in this version, if I have devtools open on a reasonably dynamic web app Chrome will crash within a minute or two
- This doesn't affect the many browsers based on Chromium?
- use after free.... ahh the irony
by kittbuilds
0 subcomment
- [dead]
- [dead]
- Isn't this a wrongly editorialized title - "Reported by Shaheen Fazim on 2026-02-11" so more like 7-day.
- I wonder if this was found with LLM assistance, if yes, with which one and is it a one-off or does it mark a start of a new era (I assume it does).
Hacker News