Zero-Day CSS: Deconstructing CVE-2026-2441