Security Intelligence
Loading table of contents...
Loading table of contents...
At a glance: CISA has added CVE-2026-2441, a high-severity Chrome and Chromium vulnerability with a public exploit available, to its Known Exploited Vulnerabilities (KEV) catalog following confirmed in-the-wild exploitation. Google and other major Chromium-based browsers have released updates to address the flaw. Organizations should upgrade to the latest versions immediately to reduce exposure.
Threat summary
On February 17, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added a flaw affecting Chrome and Chromium-based browsers to their Known Exploited Vulnerabilities (KEV) database, indicating exploitation in the wild.
Google released Chrome versions 145.0.7632.75/76 for Windows/Mac and 144.0.7559.75 for Linux operating systems worldwide on February 13, and they can be deployed through automatic or manual updates. These latest versions addressed the high-severity vulnerability, tracked as CVE-2026-2441, noting that public exploit was available.
Microsoft Edge and other Chromium-based browsers have also released updates to incorporate the latest updates of the Chromium project, including:
- Microsoft Edge Stable Channel 145.0.3800.58
- Brave v1.87.188
- Vivaldi 7.8/ 3925.70
- DuckDuckGo 7.207.0+ios and 0.145.9.0 windows
- Opera 127.0.5778.64
Analysis
Out-of-date browsers are a common entry point for threat actors, and the risk is especially high when a vulnerability is known to be actively abused, like in this case. Threat actors frequently weaponize browser flaws for drive-by downloads, sandbox escapes, and credential theft, making timely patching essential.
Chrome Windows, Mac, and Linux desktop users can manually upgrade now to the latest Chrome version by going to Settings > Help > About Google Chrome.
Administrators can configure updates to be deployed automatically through Group Policy, Mobile Device Management (MDM), or other enterprise configuration tools. Chrome, Edge, and Brave support automated update channels whereas Opera and Vivaldi do not, and require manual or scripted update workflows.
While major Chromium-based browsers, like Chrome, Microsoft Edge, Brave, and Opera, typically release security updates promptly and publish detailed release notes, smaller or niche Chromium-based browsers don't provide the same level of transparency or operational guidance. In several cases, public documentation, changelogs, and update instructions are not offered by these vendors, nor is there confirmation if they have incorporated upstream Chromium security patches.
For organizations with diverse browser usage, this creates a blind spot: even if Chrome and Edge are fully patched, even one outdated alternative browser can reintroduce risk into the environment.
To reduce the risk, organizations could:
- Standardize on well‑supported browsers that provide timely security updates and enterprise‑grade documentation.
- Inventory all browsers in use, including non‑standard or user‑installed variants, and assess whether they receive timely Chromium security patches.
- Restrict installation of unsupported or undocumented browsers through application control policies.
- Monitor vendor communication channels (if available) for update announcements, and treat silence as a potential risk indicator.
- Consider removing browsers that lack clear update mechanisms, especially in high‑security or regulated environments.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
.jpg)