Google patches first Chrome zero-day of the year - so update now or face attack

• Google patches Chrome zero-day CVE-2026-2441, a “use after free” bug in CSS
• Exploit allowed arbitrary code execution via crafted HTML pages, actively abused in the wild
• Update to Chrome 145.0.7632.75/76 (Windows/Mac) or 144.0.7559.75 (Linux) to stay protected

Google has patched a high-severity vulnerability in the Chrome browser which was apparently being used as a zero-day in the wild.

In a security advisory, Google said it addressed CVE-2026-2441, a “use after free in CSS in Google Chrome prior to 145.0.7632.75”. This bug, given a severity score of 8.3/10 (high), allows threat actors to execute arbitrary code inside a sandbox via a crafted HTML page.

Usually, Google would push all Chrome updates automatically, so if you haven’t disabled automatic updates, just restart the browser and make sure it’s running 145.0.7632.75/76 for Windows and MacOS, or 144.0.7559.75 for Linux.

First zero-day of 2026

If you have disabled automatic updates, make sure to open Chrome, click the three dots in the top-right corner, and navigate to Help - About Google Chrome. On this page, the browser will automatically start checking for updates and will download and prompt you to relaunch it.

Since the bug is being actively exploited, make sure to apply the fix as soon as possible.

"Google is aware that an exploit for CVE-2026-2441 exists in the wild," Google said in a security advisory. It did not say who the victims were, how the bug was leveraged, or who the attackers were. It said it was consciously withholding this information until the majority of browsers were patched, not to give other threat actors any advantages.

According to BleepingComputer, this is the first actively exploited Chrome vulnerability patched since the start of the year. The publication also stressed that the company patched eight zero-days last year, many of which were leveraged by state-sponsored threat actors.

The US Cybersecurity and Infrastructure Security Agency (CISA) have not yet added this bug to its catalog of known exploited vulnerabilities.

Via BleepingComputer

The best antivirus for all budgets

➡️ Read our full guide to the best antivirus
1. Best overall:
Bitdefender Total Security
2. Best for families:
Norton 360 with LifeLock
3. Best for mobile:
McAfee Mobile Security

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.