Google Chrome CVE-2026-106421

Exploitation requires the victim to open attacker-controlled web content that embeds a crafted PDF processed by Chrome's built-in PDF (PDFium) viewer - this is the triggering feature. The limiting factor is mandatory user interaction (UI:R): the user must navigate to or load the malicious page, so there is no zero-click or self-propagating vector, which is why SSVC rates it Automatable: no. Additionally, successful code execution is confined to the renderer sandbox; impact beyond the browser process requires chaining a separate sandbox-escape vulnerability. Affected: all Chrome builds prior to 155.0.8059.39; fixed in 155.0.8059.39 and later.

This is a genuine high-priority browser vulnerability but not a top-tier emergency based on current signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) confirms remote, unauthenticated, low-complexity exploitation requiring only that a victim open a crafted HTML page, with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). However, the signals diverge on urgency: CISA's SSVC decision framework reports Exploitation: none and Automatable: no (user interaction defeats mass automation), tempered against Technical Impact: total. No CISA KEV listing and no public exploit were provided in the input, so there is no evidence of active exploitation or weaponization at this time. A critical nuance the description states explicitly is that code execution occurs 'inside the sandbox' - meaning this UAF alone yields renderer-process compromise, not full host takeover; a real-world full-system attack would require chaining a separate sandbox-escape bug, which the CVSS C:H/I:H/A:H and S:U (scope unchanged) implicitly reflect. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be assessed. Net: patch promptly given Chrome's ubiquity and the low attack complexity, but there is no indication of in-the-wild exploitation.

An attacker hosts or compromises a web page containing a malicious PDF that triggers the use-after-free when rendered by Chrome's PDF component. A victim is lured to visit the page (e.g., via phishing or a malvertising redirect), and the freed-then-reused object lets the attacker execute arbitrary code within the renderer sandbox. No public proof-of-concept was identified in the provided data.