Cyber Resilience

CVE-2026-2313

High

Published: 11 February 2026

Published
11 February 2026
Modified
13 February 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0410 89.4th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-2313 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 10.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-2313 is a use-after-free vulnerability (CWE-416) in the CSS component of Google Chrome versions prior to 145.0.7632.45. It enables heap corruption when processing a crafted HTML page, as reported with Chromium security severity rated as High. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating significant potential impact.

A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website containing the crafted HTML page, requiring no special privileges. Successful exploitation could lead to arbitrary code execution, compromising the victim's system with high impacts on confidentiality, integrity, and availability.

Google addressed the vulnerability in a stable channel update for desktop, detailed at https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_10.html. Additional technical details are available in the Chromium issue tracker at https://issues.chromium.org/issues/467297219. Mitigation involves updating affected Chrome installations to version 145.0.7632.45 or later.

EU & UK References

Vulnerability details

Use after free in CSS in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CWE(s)
CWE-416

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
Why these techniques?

Use-after-free in Chrome CSS enables RCE via malicious website visit (drive-by) and client-side exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-7357Same product: Apple Macos
CVE-2026-7342Same product: Apple Macos
CVE-2026-4680Same product: Apple Macos
CVE-2026-7355Same product: Apple Macos
CVE-2026-5284Same product: Apple Macos
CVE-2026-9992Same product: Apple Macos
CVE-2026-9118Same product: Apple Macos
CVE-2026-7336Same product: Apple Macos
CVE-2026-7974Same product: Apple Macos
CVE-2026-7352Same product: Apple Macos

Affected Assets

google
chrome
≤ 145.0.7632.45

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

SI-2 requires timely flaw remediation, directly mitigating the use-after-free vulnerability by patching Google Chrome to version 145.0.7632.45 or later.

SI-16 Memory Protection good match
prevent

SI-16 enforces memory protection mechanisms like ASLR and DEP that comprehensively mitigate heap corruption resulting from the CSS use-after-free vulnerability.

SC-39 Process Isolation partial match
prevent

SC-39 provides process isolation via browser sandboxes, limiting the scope of arbitrary code execution from the exploited CSS renderer process.

References