# Exploit Title: Google Chrome < 145.0.7632.75 - CSSFontFeatureValuesMap
Use-After-Free
# Date: 2026-02-23
# Exploit Author: nu11secur1ty
# Vendor Homepage: https://www.google.com/chrome/
# Software Link: https://www.google.com/chrome/
# Version: Chrome <= 144.x | Chrome < 145.0.7632.75
# Tested on: Windows 11 / Linux / macOS
# CVE: CVE-2026-2441
# Exploit Repository:
https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2026/CVE-2026-2441
## Description
A use-after-free vulnerability exists in Google Chrome's CSS engine (Blink)
within the CSSFontFeatureValuesMap implementation. When an iterator is
created over a CSSFontFeatureValuesMap object and the underlying HashMap is
mutated during iteration, a rehash operation occurs, freeing the original
memory while the iterator still holds a raw pointer to it. This leads to a
use-after-free condition that can be exploited to execute arbitrary code
inside the Chrome sandbox.
The vulnerability was actively exploited in the wild as a zero-day before
the patch was released.
## Vulnerable Versions
- Google Chrome <= 144.x
- Google Chrome < 145.0.7632.75
- Microsoft Edge (prior to Chromium 145 update)
- Opera (prior to 127.0.5778.64)
- Any Chromium-based browser using affected Blink versions
## Technical Details
**Root Cause:** In
`third_party/blink/renderer/core/css/css_font_feature_values_map.cc`, the
`FontFeatureValuesMapIterationSource` holds a raw pointer (`const
FontFeatureAliases* aliases_`) to the internal HashMap. When the map is
mutated via `set()` or `delete()` during iteration, the HashMap rehashes,
the old storage is freed, and the pointer becomes dangling.
**Fix:** Commit `63f3cb4864c64c677cd60c76c8cb49d37d08319c` replaces the raw
pointer with a deep copy (`const FontFeatureAliases aliases_`).
## CVSS Score
**8.8 (High)** - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
## Proof of Concept
```html
CVE-2026-2441 PoC - nu11secur1ty
CVE-2026-2441 Proof of Concept
Author: nu11secur1ty
Check browser console for output. If browser crashes -> VULNERABLE
# Demo:
[href](https://www.patreon.com/posts/cve-2026-2441-151454779)
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstorm.news/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.asc3t1c-nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty