What is the CVSS score of CVE-2026-10002?

CVE-2026-10002 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10002?

A critical flaw in Google Chrome's PDF rendering engine (CVE-2026-10002, CVSS 8.8) enables remote code execution if users open specially crafted PDF files, creating potential exposure across all…. A patch is available.

How to fix or mitigate CVE-2026-10002?

Within 24 hours: verify Chrome autoupdate is enabled organization-wide and document any manual deployment controls preventing automatic updates. Within 7 days: confirm all Chrome instances are updated to version 148.0.7778.216 or later and validate version compliance across managed endpoints. Within 30 days: audit complete Chrome version inventory across organization and implement policies restricting PDF sources to trusted origins where operationally feasible.

Google Chrome CVE-2026-10002

EUVD-2026-33144 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-xcjw-33rw-v8v3

Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 17:55 vuln.today

CVSS changed

May 29, 2026 - 17:52 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's PDFium component (versions prior to 148.0.7778.216) allows a remote attacker to potentially achieve code execution by tricking a user into opening a crafted PDF file. The flaw is a use-after-free condition rated High severity by Chromium, with no public exploit identified at time of analysis and a low EPSS score (0.03%) suggesting limited near-term mass exploitation despite a CVSS of 8.8. A vendor patch has been released via the Chrome Stable channel update.

Technical ContextAI

PDFium is the open-source PDF rendering library embedded in Chromium-based browsers (Chrome, Edge, Brave, Opera, and others) that parses and renders PDF documents within the browser process tree. The CWE-416 (Use After Free) class of bug occurs when a program continues to reference heap memory after it has been freed, allowing an attacker who can influence subsequent heap allocations to place attacker-controlled data where the dangling pointer is dereferenced - typically leading to type confusion, arbitrary read/write, and control-flow hijack. PDFium has been a recurring source of UAF vulnerabilities due to the complexity of PDF object lifetimes (annotations, form fields, JavaScript objects) and the asynchronous nature of rendering. The affected CPE (cpe:2.3:a:google:chrome) confirms the scope is the Chrome browser distribution of PDFium.

RemediationAI

Vendor-released patch: update Google Chrome to version 148.0.7778.216 or later via the Stable channel - most installations will auto-update on next browser relaunch, so enforcing a browser restart across the fleet is the fastest remediation. Administrators managing enterprise Chrome deployments should verify the rollout via the Google Admin console or ChromeForTesting download endpoints, and confirm Edge/Brave/Opera/Electron downstream versions have absorbed the PDFium fix before considering those environments patched. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. As a compensating control until patching completes, disable Chrome's internal PDF viewer by setting the AlwaysOpenPdfExternally enterprise policy to true (forces PDFs to download instead of render in-browser) - the trade-off is degraded user experience and reliance on whatever external PDF reader handles the file, which may itself be vulnerable; alternatively, block inline PDF delivery at the web/email gateway, which breaks legitimate PDF workflows.