10 ms·
Zero-day CSS: CVE-2026-2441 exists in the wild
- deleted 7mo ago[deleted]
- idoxer 7mo ago[dead]
- tripplyons 7mo ago"Use after free in CSS" is a funny description to see.
- w4yai 7mo agoWhy ?
- 8-prime 7mo agoTo me at least it reads funny because when I think of CSS I think of the language itself and not the accompanying tools that are then running the CSS. Saying "Markdown has a CVE" would sound equally off. I'm aware that its not actually CSS having the vulnerability but when simplified that's what it sounds like.
- deleted 7mo ago[deleted]
- Tyr42 7mo agoFunny you'd mention that, when Notepad had a CVE in it's markdown parsing recently.
- deleted 7mo ago[deleted]
- maxloh 7mo agoI think they meant something like the CSS parser, or the CSS Object Model (CSSOM).
- bawolff 7mo agoOne of the other commenters wrote a post that said it was related to @font-feature-values
- mpeg 7mo ago"Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera." That's pretty bad! I wonder what kind of bounty went to the researcher.
- waynesonfire 7mo ago"Actually, you forgot Brave."
- mpeg 7mo agoI quoted directly from NIST, there's many other browsers and non-browsers that use chromium
- waynesonfire 7mo agoIt was intended as a joke reference to the 2004 Kerry / Bush debate. It's not a coincidence that Google would leave off an ad-blocking variant of Chrome.
- order-matters 7mo agothey listed the top 3 most popular chromium browsers, covering 90%+ of chromium users
- ipaddr 7mo agoBut not 90% of users here.
- pear01 7mo agodid you also take poland being omitted to be some sort of conspiracy? seems you missed the point of why that "Actually, you forgot..." moment became such a punchline. Like it or not Brave is a very niche browser with rather insignificant market share why you would expect them to be mentioned in the first place is entirely lost on me. there are dozens of chromium forks also with under 1% market share, should we be forced to mention them all?
- baq 7mo agoI wonder if this was found with LLM assistance, if yes, with which one and is it a one-off or does it mark a start of a new era (I assume it does).
- paavohtl 7mo agoAbsolutely nothing in the announcement or other publicly available source implies that, to my knowledge. Might as well speculate if a random passer-by on the street is secretly a martian.
- eks391 7mo agoIf you haven't seen news related to LLM generated bug reports, they are pretty disliked due to poor quality. So yes, a new LLM generated bug report era has begun, and the results so far have been moderator/developer burnout, increased time between real bugs being taken care of (as devs treat each submission as a true possible bug), and many projects no longer accepting bug reports. I have seen a couple anecdotal incidents when someone used LLMs to generate real bugs, one guy showing off a chain he made to HN, and that was really neat. LLMs aren't unable to make reports, but scammers and vibecoders see the dollar signs that they aren't going to put real effort in trying to get, and submit every response from a prompt similar to "provide me a bug report for [XX package/app]" in hopes that one pays out. The individuals I saw make real bug reports were already developers and were able to test out and iterate with the code the LLM provided, making connections of their own, just like any other person who uses LLMs responsibly instead of outsourcing thinking.
- MallocVoidstar 7mo agoDevtools is seemingly partially broken in this version, if I have devtools open on a reasonably dynamic web app Chrome will crash within a minute or two
- aapoalas 7mo agoIt's also been ridiculously slow for a month or two now :/ not a good time to be working on some relatively intricate performance optimisation with DevTools taking 1-4 seconds to even start the performance recording.
- himata4113 7mo agoThe fact that these still show up is pretty wild to me. Don't we have a bunch of tools that should create memory-safish binaries by applying the same validation checks that memory-safe languages get for free purely from their design? I get that css has changed a lot over the years with variables, scopes and adopting things from less/sass/coffee, but people use no-script for the reason because javascript is risky, but what if css can be just as risky... time to also have no-style? Honestly, pretty excited for the full report since it's either stupid as hell or a multi-step attack chain.
- staticassertion 7mo ago> Don't we have a bunch of tools that should create memory-safish binaries by applying the same validation checks that memory-safe languages get for free purely from their design? No, we don't. All of the ones we have are heavily leveraged in Chromium or were outright developed at Google for similar projects. 10s of billions are spent to try to get Chromium to not have these vulnerabilities, using those tools. And here we are. I'll elaborate a bit. Things like sanitizers largely rely on test coverage. Google spends a lot of money on things like fuzzing, but coverage is still a critical requirement. For a massive codebase, gettign proper coverage is obviously really tricky. We'll have to learn more about this vulnerability but you can see how even just that limitation alone is sufficient to explain gaps.
- masklinn 7mo ago> Things like sanitizers largely rely on test coverage. And not in a trivial “this line is traversed” way, you need to actually trigger the error condition at runtime for a sanitizer to see anything. Which is why I always shake my head at claims that go has “amazing thread safety” because it has the race detector (aka tsan). That’s the opposite of thread safety. It is, if anything, an admission to a lack of it.
- josefx 7mo agoI heard they once created an entire language that would replace C++ in all their projects. Obviously they never rewrote Chrome in Go. > 10s of billions are spent to try to get Chromium to not have these vulnerabilities, using those tools. And here we are. Shouldn't pages run in isolated and sandboxed processes anyway? If that exploit gets you anywhere it would be a failure of multiple layers.
- fulafel 7mo agoIsn't this a wrongly editorialized title - "Reported by Shaheen Fazim on 2026-02-11" so more like 7-day.
- Aachen 7mo agoIt refers to your many days software is available for, with zero implying it is not yet out so you couldn't have installed a new version and that's what makes it a risky bug The term has long watered-down to mean any vulnerability (since it was always a zero-day at some point before the patch release, I guess is those people's logic? idk). Fear inflation and shoehorning seems to happen to any type of scary/scarier/scariest attack term. Might be easiest not to put too much thought into media headlines containing 0day, hacker, crypto, AI, etc. Recently saw non-R RCEs and supply chain attacks not being about anyone's supply chain copied happily onto HN Edit: fwiw, I'm not the downvoter
- nickelpro 7mo agoIt's original meaning was days since software release, without any security connotation attached. It came from the warez scene, where groups competed to crack software and make it available to the scene earlier and earlier. A week after general release, three days, same-day. The ultimate was 0-day software, software which was not yet available to the general public. In a security context, it has come to mean days since a mitigation was released. Prior to disclosure or mitigation, all vulnerabilities are "0-day", which may be for weeks, months, or years. It's not really an inflation of the term, just a shifting of context. "Days since software was released" -> "Days since a mitigation for a given vulnerability was released".
- fulafel 7mo agoWikipedia: A zero-day (also known as a 0-day) is a vulnerability or security hole in a computer system unknown to its developers or anyone capable of mitigating it This seems logical since by etymology of zeroday it should apply to the release (=disclosure) of a vuln.
- 7mo ago
- bitbasher 7mo agoMaybe Chromium should also rewrite their rendering engine in Rust ;p
- silverwind 7mo agoThey could just invest into Servo's and use that.
- esprehn 7mo agoYou joke, but a substantial portion of the Blink engine was (re)written in garbage collected C++ to a similar effect.
- astrobe_ 7mo agoThis doesn't affect the many browsers based on Chromium?
- iririririr 7mo agowhy on earth would you even assume somthing like this? honestly curious. do you think "based on chrome" means they forked the engine and not just "applied some UI skin"?
- astrobe_ 7mo agoThe CVE itself only lists Chrome as the "affected software configuration", and I missed the line saying other browsers in the blog post, so I had a slight doubt. Other projects could use a drop-in replacement lib for the CSS, that's something one sees sometimes for other things (e.g. crypto libs - some projects have compile-time options ready for this).
- iririririr 7mo agoThey would have been if they could patch and release under a day. They are not affected only because they lag behind a little. Why do you dream things up? no chrome based browser will do html/js/css different. it's all hooked deep in the engine. they only add things on top and change the chrome (the confusingly named ux component)
- thinkingemote 7mo ago"This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera"
- gruez 7mo agoIt does, it's just that blog is for chrome so it doesn't mention other browsers.
- ripbozo 7mo agoI'd love to see what the PoC code looks like, of course after the patch has been rolled out for a few weeks.
- andreasley 7mo agoHere's one: https://github.com/huseyinstif/CVE-2026-2441-PoC https://github.com/huseyinstif/CVE-2026-2441-PoC
- kittbuilds 7mo ago[dead]
- jijji 7mo agouse after free.... ahh the irony
- agentifysh 7mo agothis is insane! what other zero days are out there and being used also this seems chromium only so it doesnt impact firefox ?
- mattstir 7mo agoYeah, Firefox uses a different CSS engine that doesn't automatically have this same use-after-free.
- kykat 7mo agoI don't quite understand the vulnerability, when exploited, you can get information about the page from which the exploit code is running. Without a sandbox escape or XSS, that seems almost completely harmless? This is the "impact" section on https://github.com/huseyinstif/CVE-2026-2441-PoC https://github.com/huseyinstif/CVE-2026-2441-PoC: Arbitrary code execution within the renderer process sandbox Information disclosure — leak V8 heap pointers (ASLR bypass), read renderer memory contents Credential theft — read document.cookie, localStorage, sessionStorage, form input values Session hijacking — steal session tokens, exfiltrate via fetch() / WebSocket / sendBeacon() DOM manipulation — inject phishing forms, modify page content Keylogging — capture all keystrokes via addEventListener('keydown')
- chc4 7mo agoBrowser exploits are almost always two steps: you exploit a renderer bug in order to get arbitrary code execution inside a sandboxed process, and then you use a second sandbox escape exploit in order to gain arbitrary code execution in the non-sandboxed broker process. The first line of that (almost definitely AI generated) summary is the bad part, and means that this is one half of a full browser compromise chain. The fact that you still need a sandbox escape doesn't mean that it is harmless, especially since if it's being exploited in the wild that means whoever is using it probably does also have a sandbox escape they are pairing with it.
- kykat 7mo agoThanks for the explanation. So much for AI making it easier to learn things!
- keepamovin 7mo ago[flagged]
- cosmic_cheese 7mo agoI wonder how many bugs like this are lurking in the various dark corners of the Chromium/Blink codebase that nobody has taken a good, hard look at in a long time. Given the staggering importance of the projects they should really have a full-time, well-staffed, well-funded, dedicated team combing through every line, hunting these things down, and fixing them before they have a chance to be used. It'd be a better use of resources than smart fridge integration or whatever other bells and whistles Google has most recently decided to tack onto Chrome.
- sproketboy 7mo ago[dead]
- StilesCrisis 7mo agoChromium is pretty aggressively fuzzed. There aren't a lot of dark corners that can't be reached via a sufficiently aggressive fuzzer.
- anematode 7mo agoNot sure about that one. Fuzzers have a hard time creating certain narrow preconditions that a manual review can find.
- yalok 7mo agois Google using LLM-guided fuzzers that can inspect the code first?
- bastawhiz 7mo agoGoogle, to their credit, has invested a TON of money into both manual review and also fuzzers. Every major fuzzing project I've read about in the last few years has been at least funded in part by Google.
- UncleMeat 7mo agoThey’ve gotten way better at this over the last decade with coverage guided execution.
- RyanShook 7mo agoI always wonder how many zero-days exist on purpose…
- Arch485 7mo agoI've heard this sentiment a lot, that governments/secret agencies/whoever create zero-days intentionally, for their own use. This is an interesting thought to me (like, how does one create a zero-day that doesn't look intentional?) but the more I think about it, the more I start to believe that this fully is not necessary. There are enough faulty humans and memory unsafe languages in the loop that there will always be a zero-day somewhere, you just need to find it. (this isn't to say something like the NSA has never created or ordered the creation of a backdoor - I just don't think it would be in the form of an "unintentional" zero-day exploit)
- taftster 7mo agoI'm not sure that governments actually create them, not prolifically at least. There's been some state actor influence over the years, for sure. However, exploits that are known (only) by a state actor would most definitely be a closely guarded secret. It's only convenient for a state to release information about an exploit when either it's been made public or it has more consequences for not releasing. So yes, exactly what you said. It's easier to find the exploits than to create them yourself. By extrapolation, you would have to assume that each state maintains its set of secret exploits, possibly never getting to use them for fear of the other side knowing of their existence. Cat & Mouse, Spy vs Spy for sure.
- spragl 7mo agoI think you are right that the shady actors pretty much can use existing bugs. But you are also right that this is not the only way they work. With the XZ Utils backdoor (2024), we normal nerds got an interesting glimpse into how they create a zero-day. It was luckily discovered by an american developer not looking for zero-days, just debugging a performance problem.
- bauruine 7mo agoThe NSA surely has ordered a backdoor. >In December 2013, a Reuters news article alleged that in 2004, before NIST standardized Dual_EC_DRBG, NSA paid RSA Security $10 million in a secret deal to use Dual_EC_DRBG as the default in the RSA BSAFE cryptography library https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
- kingforaday 7mo ago"Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL." Interesting they are listing archived projects and not OSS-Fuzz. What's the reason for this?
- squirrellous 7mo agoI thought OSS-fuzz still uses the aforementioned sanitizers and fuzz engines. It is not by itself a fuzzing engine.
- deleted 7mo ago[deleted]
- nicggckgcbnn 7mo ago[flagged]
- cindyllm 7mo ago[dead]
- superkuh 7mo agoWhen I try to look up the CVE/issue I get, https://issues.chromium.org/issues/483569511 https://issues.chromium.org/issues/483569511 - [TBD][483569511] High CVE-2026-2441: Use after free in CSS. Reported by Shaheen Fazim on 2026-02-11 > Access is denied to this issue. Access to this issue may be resolved by signing in.
- hussainsumon018 7mo ago"Which reinforces the idea that this was optimized for porn" and I am almost hack online casino and hot photos from pussey or BOOBS... and put...
- ROBERT234 7mo ago[dead]