CVE-2026-2441 is a reported (but as yet unconfirmed in MITRE/NVD) zero-day vulnerability in Chrome's CSS parsing engine. It exploits the interaction between CSS `@property` registration and `paint()` worklet initialization to trigger a use-after-free condition on the compositor thread, potentially enabling a sandbox escape from the renderer to the GPU process — without any JavaScript in the payload. The article explains the technical exploit chain in detail, identifies high-risk application patterns (user-supplied CSS, Electron apps, unsandboxed iframes), and provides ready-to-deploy CSP header templates for Apache, Nginx, and Express.js. It also includes a Node.js CLI detection script and a browser DevTools snippet for auditing CSP posture, plus a GitHub Actions CI/CD integration example. The broader takeaway is that CSS Houdini APIs have made CSS injection a script-adjacent threat in Chromium-based environments.
