huseyinstif/CVE-2026-2441-PoC is a proof of concept for CVE-2026-2441, the in-the-wild use-after-free in Chrome’s Blink CSSFontFeatureValuesMap.
Its poc.html mutates the map while iterating over it until a rehash leaves the iterator’s raw pointer dangling, which crashes unpatched renderers (before 145.0.7632.75 on Windows and macOS, 144.0.7559.75 on Linux): handy for checking patch status, not a weaponized exploit.
Shaheen Fazim reported the bug on 11 February, Google shipped the fix two days later, and CISA added it to KEV on 17 February.
