What is the CVSS score of CVE-2026-10002?

CVE-2026-10002 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10002?

A critical flaw in Google Chrome's PDF rendering engine (CVE-2026-10002, CVSS 8.8) enables remote code execution if users open specially crafted PDF files, creating potential exposure across all…. A patch is available.

How to fix or mitigate CVE-2026-10002?

Within 24 hours: verify Chrome autoupdate is enabled organization-wide and document any manual deployment controls preventing automatic updates. Within 7 days: confirm all Chrome instances are updated to version 148.0.7778.216 or later and validate version compliance across managed endpoints. Within 30 days: audit complete Chrome version inventory across organization and implement policies restricting PDF sources to trusted origins where operationally feasible.

Google Chrome CVE-2026-10002

EUVD-2026-33144 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-xcjw-33rw-v8v3

Google Use After Free Denial Of Service Memory Corruption Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 17:55 vuln.today

CVSS changed

May 29, 2026 - 17:52 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's PDFium component (versions prior to 148.0.7778.216) allows a remote attacker to potentially achieve code execution by tricking a user into opening a crafted PDF file. The flaw is a use-after-free condition rated High severity by Chromium, with no public exploit identified at time of analysis and a low EPSS score (0.03%) suggesting limited near-term mass exploitation despite a CVSS of 8.8. A vendor patch has been released via the Chrome Stable channel update.

Technical ContextAI

PDFium is the open-source PDF rendering library embedded in Chromium-based browsers (Chrome, Edge, Brave, Opera, and others) that parses and renders PDF documents within the browser process tree. The CWE-416 (Use After Free) class of bug occurs when a program continues to reference heap memory after it has been freed, allowing an attacker who can influence subsequent heap allocations to place attacker-controlled data where the dangling pointer is dereferenced - typically leading to type confusion, arbitrary read/write, and control-flow hijack. PDFium has been a recurring source of UAF vulnerabilities due to the complexity of PDF object lifetimes (annotations, form fields, JavaScript objects) and the asynchronous nature of rendering. The affected CPE (cpe:2.3:a:google:chrome) confirms the scope is the Chrome browser distribution of PDFium.

RemediationAI

Vendor-released patch: update Google Chrome to version 148.0.7778.216 or later via the Stable channel - most installations will auto-update on next browser relaunch, so enforcing a browser restart across the fleet is the fastest remediation. Administrators managing enterprise Chrome deployments should verify the rollout via the Google Admin console or ChromeForTesting download endpoints, and confirm Edge/Brave/Opera/Electron downstream versions have absorbed the PDFium fix before considering those environments patched. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. As a compensating control until patching completes, disable Chrome's internal PDF viewer by setting the AlwaysOpenPdfExternally enterprise policy to true (forces PDFs to download instead of render in-browser) - the trade-off is degraded user experience and reliance on whatever external PDF reader handles the file, which may itself be vulnerable; alternatively, block inline PDF delivery at the web/email gateway, which breaks legitimate PDF workflows.