# they hacked CSS Source: https://www.youtube.com/watch?v=AZUp5nY7BWU Recap page: https://rapidrecap.app/video/AZUp5nY7BWU Generated: 2026-02-18T16:05:39.757+00:00 --- ## Quick Overview Google Chrome has been patched against a critical use-after-free zero-day vulnerability (CVE-2026-2441) in its CSS handling, which allowed remote attackers to execute arbitrary code via crafted HTML pages, highlighting the ongoing threat of browser-based flaws being actively exploited in the wild. **Key Points:** - Google released security updates addressing CVE-2026-2441, a high-severity zero-day Chrome vulnerability that was under active exploitation. - The vulnerability, rated CVSS score 8.8, was discovered and reported by security researcher Shaheen Fazim on February 11, 2026. - The flaw was a 'Use after free in CSS' bug that allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. - Google acknowledged that an exploit for CVE-2026-2441 already existed in the wild, though they did not disclose details about the ongoing attacks. - The video also contrasts this with a C/C++ use-after-free example (struct cat/dog pointers) to explain how the browser vulnerability works by confusing pointer references. - The patch for this specific Chrome flaw involves changes in the CSS font feature values map iteration to prevent stale iterator state when modifications occur during iteration, a method Rust typically avoids. - Users are advised to update Chrome to versions 145.0.7632.75 (Windows/macOS) and 144.0.7559.75 (Linux) for optimal protection. ![Screenshot at 00:05: The video begins displaying the headline from The Hacker News article confirming that a "New Chrome Zero-Day \(CVE-2026-2441\) Under Active Attack – Patch Released" has occurred.](https://ss.rapidrecap.app/screens/AZUp5nY7BWU/00-00-05.jpg) **Context:** The video discusses a recently disclosed and actively exploited zero-day vulnerability in Google Chrome, tracked as CVE-2026-2441. This type of vulnerability, which involves improper memory management (use-after-free) within the browser's rendering engine when processing CSS, is particularly dangerous because it allows attackers to execute malicious code simply by tricking a user into visiting a specially crafted webpage. The presenter details the technical nature of the flaw, relating it to memory corruption concepts in C/C++, and highlights the corresponding patch implemented in Chromium. ## Detailed Analysis The video reports on the disclosure and patching of Chrome zero-day vulnerability CVE-2026-2441, which was actively exploited. This high-severity (CVSS 8.8) flaw involved a 'Use after free in CSS' bug discovered by Shaheen Fazim, enabling remote attackers to execute arbitrary code by serving malicious HTML. The presenter explains the technical basis by demonstrating a similar concept in C/C++ using overlapping struct pointers (cat and dog) to show how freeing one pointer while retaining a reference leads to use-after-free, which an attacker can exploit to corrupt memory or redirect execution flow. The actual fix, detailed in a Chromium commit, involves changing how the CSS FontFeatureValuesMap is iterated, specifically by taking a snapshot of the map before iteration to avoid stale iterator states when modifications happen, a technique Rust's memory safety features naturally prevent. The presenter notes that browsers like Chrome and Firefox, which rely on C++ for rendering components, are more susceptible to these memory-safety bugs compared to Rust-based components. Users are urged to update immediately to the patched versions (145.0.7632.75 for Windows/macOS, 144.0.7559.75 for Linux). ### Chrome Zero-Day - CVE-2026-2441 - High-severity use-after-free in CSS parsing - Actively exploited in the wild by threat actors - Patch released by Google ### Vulnerability Details - Score 8.8, reported by Shaheen Fazim on 02/11/2026 - Allowed remote attacker to execute arbitrary code via crafted HTML page ### C/C++ Analogy - Demonstrates UAF using overlapping struct pointers (struct cat/dog) where freeing one pointer while another still points to the memory location leads to corruption ### The Fix (Chromium Commit) - Avoided stale iteration by taking a snapshot of the CSSFontFeatureValuesMap when creating the iteration source, preventing iterator invalidation during modification ### Browser Context - Notes that browser components written in C++ (like Chrome's ANGLE renderer) are more prone to these memory safety issues than Rust components ### Call to Action - Users must update Chrome to version 145.0.7632.75 (Win/macOS) or 144.0.7559.75 (Linux) for protection ![Screenshot at 00:00: Presenter opening the video, setting the stage for a security discussion.](https://ss.rapidrecap.app/screens/AZUp5nY7BWU/00-00-00.jpg) ![Screenshot at 00:05: The initial news article displayed, confirming the active exploitation of Chrome zero-day CVE-2026-2441.](https://ss.rapidrecap.app/screens/AZUp5nY7BWU/00-00-05.jpg) ![Screenshot at 01:29: Sponsor advertisement for Flare, a threat intelligence platform.](https://ss.rapidrecap.app/screens/AZUp5nY7BWU/00-01-29.jpg) ![Screenshot at 03:15: C/C++ code snippet illustrating struct definitions \(cat and dog\) used to explain the memory corruption vulnerability concept.](https://ss.rapidrecap.app/screens/AZUp5nY7BWU/00-03-15.jpg) ![Screenshot at 06:00: Code comparison view from a Chromium review showing the 'before' \(left, red highlights\) and 'after' \(right, green highlights\) code for the patch implemented.](https://ss.rapidrecap.app/screens/AZUp5nY7BWU/00-06-00.jpg)