What Is CVE-2026-2441?

CVE-2026-2441 is a zero-day CSS exfiltration vulnerability in Chrome's Blink rendering engine that allowed attackers to steal sensitive DOM content—such as CSRF tokens—by chaining @import redirects and attribute selectors to trigger sequential network requests to attacker-controlled servers, all without executing any JavaScript. It carries a CVSS 3.1 base score of 6.5 (Medium) and affected all Chromium-based browsers prior to the patched stable release.

For years, frontend developers have treated CSS as fundamentally harmless. JavaScript gets the security audits, the CSP lockdowns, the sanitization libraries. CSS? It just makes things pretty.…