CISA Flags First Actively Exploited Chrome Zero-Day of 2026 Amid Wave of Critical Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency delivered a stark reminder on February 18, 2026, that the threat landscape never sleeps. In a single bulletin, CISA added four known exploited vulnerabilities to its catalog, including the first actively exploited Google Chrome zero-day of the year — a use-after-free flaw in the browser’s CSS component that could give attackers full control of affected systems.

The Exploit Mechanics

The headline vulnerability, tracked as CVE-2026-2441, carries a CVSS score of 8.8 and exists in Google Chrome versions prior to 145.0.7632.75. The bug lives in Chrome’s CSS rendering engine, where improper memory management creates a use-after-free condition. When a user visits a maliciously crafted webpage, the browser frees memory that is still being referenced, allowing an attacker to execute arbitrary code in the context of the browser process. Security researcher Shaheen Fazim discovered the flaw on February 11, 2026, and Google confirmed that active exploitation is underway in the wild.

For cryptocurrency users, this vulnerability hits particularly close to home. Browser-based wallets, DeFi interfaces, and exchange dashboards all run within Chrome. A compromised browser session can expose private keys, seed phrases, and authentication tokens without the user ever realizing their environment has been tainted. Google has patched the issue, but the window between disclosure and user updates represents a critical exposure period.

Affected Systems

Alongside the Chrome zero-day, CISA added three additional vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2024-7694 (CVSS 7.2) targets TeamT5 ThreatSonar Anti-Ransomware, where an authenticated attacker with administrator privileges can upload malicious files and execute arbitrary system commands — ironically compromising a security tool meant to defend against ransomware.

CVE-2020-7796 (CVSS 9.8) is a Server-Side Request Forgery vulnerability in Zimbra Collaboration Suite that has seen renewed exploitation. An attacker can trick the Zimbra server into making unauthorized outbound requests, potentially accessing internal services and sensitive resources. Threat intelligence firm GreyNoise observed coordinated SSRF exploitation attempts targeting entities in the United States, Germany, and Singapore throughout early 2026.

The oldest entry, CVE-2008-0015 (CVSS 8.8), is a Microsoft Windows Video ActiveX Control Remote Code Execution vulnerability — a flaw that has persisted for nearly two decades and continues to be exploited in targeted attacks against legacy systems.

The Mitigation Strategy

Organizations and individual users should prioritize immediate Chrome updates to version 145.0.7632.75 or later. For crypto users specifically, this means not only updating the browser but also verifying that browser extensions — including wallet plugins like MetaMask, Phantom, and others — are running on the latest versions. Enterprise security teams should audit their Zimbra deployments and ensure the WebEx Zimlet JSP component is disabled if not required.

The inclusion of a security product vulnerability (TeamT5 ThreatSonar) in the catalog highlights a troubling trend: attackers are increasingly targeting defensive tools themselves. Security teams should implement additional monitoring around anti-ransomware platforms and restrict administrative access to these systems using least-privilege principles.

Lessons Learned

The February 18 CISA update underscores several persistent patterns in the cybersecurity landscape. First, browser-based attacks remain one of the most effective vectors for compromising cryptocurrency users. Second, old vulnerabilities never truly die — the inclusion of a flaw from 2008 demonstrates that legacy systems continue to present attack surfaces. Third, the exploitation of security tools themselves represents an evolution in attacker tradecraft that demands a reassessment of trust assumptions across the entire security stack.

With Bitcoin trading near $66,425 and Ethereum at approximately $1,954, the total value locked in browser-accessible crypto applications represents a massive incentive for attackers to continue investing in browser exploitation techniques. The stakes are too high for complacency.

User Action Required

Update Chrome immediately. Verify all browser extensions are current. If you use Zimbra in your organization, apply Patch 7 or later. Audit any TeamT5 ThreatSonar deployments for unauthorized file uploads. For cryptocurrency users, consider using a dedicated browser profile for DeFi and trading activities to minimize exposure to compromised websites. Hardware wallet users should verify that their firmware is up to date and that transaction signing always occurs on the device itself, never through a browser interface.

Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research and consult with qualified professionals before making security decisions.