Update Chrome now: Zero-day bug allows code execution via malicious webpages

Estimated reading time: 4 minutes

Key Takeaways:

  • Google has patched CVE-2026-2441, a high-severity zero-day vulnerability being exploited in the wild.
  • The flaw involves a use-after-free error in Chrome’s CSS font feature handling, allowing arbitrary code execution.
  • Concurrent threats like the Keenadu Android backdoor and Dell RecoverPoint flaws highlight a rising trend in supply-chain and infrastructure attacks.
  • Immediate remediation requires updating Chromium-based browsers to version 145.0.7632.75/76 or higher.

Table of Contents:

Google has released an emergency patch for the first Chrome zero-day vulnerability of 2026. This vulnerability, tracked as CVE-2026-2441, is a high-severity memory corruption bug that facilitates arbitrary code execution via crafted HTML content. Intelligence indicates that this flaw is currently being exploited in the wild. The patch was issued as an out-of-band update for the stable channel, highlighting the immediate risk to users and organizations utilizing Chromium-based browsers.

Illustration of Chrome browser with warning symbol representing zero-day exploit CVE-2026-2441

The primary risk associated with CVE-2026-2441 is the ability for an external actor to execute code within the browser’s sandbox environment. This is achieved when a user visits a malicious or compromised webpage. Organizations must prioritize the deployment of version 145.0.7632.75/76 for Windows and macOS, and 145.0.7632.75 for Linux. Failure to remediate this vulnerability leaves endpoints susceptible to session hijacking, data exfiltration from open tabs, and potential sandbox escapes when chained with other exploits.

Technical Analysis of CVE-2026-2441

The vulnerability is categorized as a use-after-free (UAF) error within Chrome’s CSS font feature handling, specifically the CSSFontFeatureValuesMap. This component manages how websites define and render specific font styles. The root cause is identified as an iterator invalidation bug.

During the processing of CSS font features, the browser engine loops over a set of font feature values. If the set is modified while the loop is still active, the iterator becomes invalid. This leads the program to access memory that has already been freed or reallocated. By carefully crafting an HTML page, an attacker can manipulate this memory state to redirect the execution flow to a malicious payload.

While the code execution is initially restricted to the Chrome sandbox, a compromised tab grants the attacker access to all data within that process.

This includes:

1. Active session tokens and cookies.

2. Input data entered into web forms.

3. Access to cloud service interfaces currently logged in within the browser.

4. The ability to plant persistent backdoors in web-based applications.

If this vulnerability is combined with an operating system-level flaw, the attacker can move beyond the browser to gain full system control. This highlights the necessity of a cyber threat intelligence platform to monitor for exploit chains that target both client-side applications and underlying infrastructure.

The Broader Threat Environment: Supply Chain and Server-Side Exploits

The Chrome zero-day occurs alongside other significant threats that target different layers of the technology stack. Analyzing these concurrent threats provides a comprehensive view of the current risk environment.

Keenadu Android Backdoor and Supply-Chain Risk

Recent research has identified the Keenadu backdoor, a sophisticated malware platform embedded in the firmware of various Android tablets. Unlike traditional app-based malware, Keenadu is integrated into the libandroid_runtime.so library during the firmware build phase. This represents a failure in supply-chain risk monitoring at the manufacturer level.

  • Infection: Targets the Zygote process, the parent for all Android applications.
  • Injection: Malicious copies of the backdoor are placed into every application launched.
  • Privilege Hijacking: Bypasses the Android permission model to grant system privileges.
  • Traffic Redirection: Hijacks Chrome search queries to malicious search engines.

Organizations must use advanced intelligence to identify if fleet devices are running compromised firmware, as standard factory resets often fail to remove firmware-level infections.

Dell RecoverPoint Zero-Day (CVE-2026-22769)

Simultaneously, a critical vulnerability has been identified in Dell RecoverPoint for Virtual Machines. Tracked as CVE-2026-22769, this flaw involves hardcoded credentials that allow unauthenticated remote attackers to gain root-level access to the underlying operating system.

The threat group UNC6201 has been observed exploiting this flaw to deploy the Grimbolt backdoor. This group uses “Ghost NICs”-temporary virtual network ports on VMware ESXi servers-to move laterally across networks while avoiding traditional breach detection tools. This underscores the importance of real-time intelligence, as unauthorized access points are frequently sold to ransomware affiliates.

Ivanti EPMM Remote Code Execution (CVE-2026-1281 and CVE-2026-1340)

Two additional zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) are currently under active exploitation. These flaws reside in legacy bash scripts used by the Apache web server for URL rewriting.

The vulnerabilities allow unauthenticated attackers to achieve RCE through bash arithmetic expansion. Attackers inject commands into URL parameters, leading to the deployment of reverse shells and JSP web shells. These are particularly dangerous because they target Mobile Device Management (MDM) infrastructure.

Monitoring External Threats and Data Leaks

As vulnerabilities like the Chrome zero-day and the Ivanti RCE are weaponized, attackers often utilize automated scanners to find unpatched instances. Effective defense requires a dark web monitoring service and telegram threat monitoring to identify:

  1. Discussions regarding new exploit PoCs (Proof of Concepts).
  2. Leaked administrative credentials from compromised MDM or backup servers.
  3. The sale of access to corporate networks via previously exploited zero-days.

Furthermore, brand leak alerting can notify organizations when their internal infrastructure details appear in attacker-controlled databases. Integrating a live ransomware API into security operations centers (SOC) allows for the correlation of these leaks with known ransomware group activities.

Remediation and Mitigation Strategies

Technical Takeaways for Engineers

  • Browser Patching: Force the update of Google Chrome to version 145.0.7632.75/76 or later. Use GPO or MDM profiles to ensure a restart is forced.
  • Infrastructure Hardening: Upgrade Dell RecoverPoint to version 6.0.3.1 HF1 or later to invalidate hardcoded credentials.
  • Ivanti EPMM Mitigation: Apply version-specific RPM patches. Review logs for requests directed at /mifs/c/appstore/fob/ containing =gPath.
  • Device Auditing: Audit Android system libraries for modifications to libandroid_runtime.so.
  • Network Segmentation: Isolate management interfaces from the public internet using Zero Trust Network Access (ZTNA).

Administrative Takeaways for Business Leaders

  • Vulnerability Lifecycle: Minimize the time between disclosure and patching; the window for exploitation is now measured in hours.
  • Supply Chain Verification: Review the security posture of hardware vendors, ensuring firmware updates are signed and verified.
  • Credential Policy: Review all systems for hardcoded credentials and implement Multi-Factor Authentication (MFA) everywhere.

PurpleOps Expertise in Vulnerability Management

PurpleOps provides comprehensive solutions to address the complexities of modern vulnerability management. Our platform and services are designed to identify and mitigate risks before compromise.

Frequently Asked Questions

What is CVE-2026-2441?

It is a high-severity use-after-free vulnerability in Google Chrome’s CSS font handling that allows attackers to execute arbitrary code when a user visits a malicious website.

How do I know if my Chrome browser is protected?

You must ensure your browser is updated to version 145.0.7632.75/76 (Windows/macOS) or 145.0.7632.75 (Linux) or later.

What makes the Keenadu backdoor particularly dangerous?

Keenadu is embedded in the Android firmware library, meaning it survives factory resets and infects every application launched on the device from the system level.

What are “Ghost NICs” in the context of the Dell vulnerability?

Ghost NICs are temporary virtual network ports used by attackers to move laterally through virtualized environments while bypassing standard security monitoring tools.

How can organizations defend against Ivanti EPMM RCE exploits?

Organizations should apply official RPM patches immediately and isolate their MDM management interfaces from the public-facing internet.