Google Chrome CVE-2026-110136

Exploitation requires the victim to open a crafted HTML page that loads a malicious PDF handled by Chrome's built-in PDF component (the specific attack surface named in the description), so the PDF viewer must be reachable/enabled, which it is by default. The key limiting factor is required user interaction (CVSS UI:R): the attacker cannot trigger the flaw without the user navigating to attacker-controlled content, so social engineering or a compromised/malvertised site is a prerequisite. No authentication is required (PR:N), and default Chrome configurations on versions prior to 155.0.8059.79 are affected; patched builds (155.0.8059.79 and later, including the Extended Stable channel update) remove the condition.

Signals are mixed and should be read together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6 Critical) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page, with a scope change reflecting the sandbox escape - a genuinely severe profile for a browser bug. Counterbalancing this, EPSS is only 0.21% (11th percentile), the CVE is NOT on CISA KEV, no public exploit is referenced, and CISA SSVC records Exploitation: none and Automatable: no (though Technical Impact: total aligns with the CVSS impact metrics). The low EPSS and 'Automatable: no' are consistent with a bug that is not yet weaponized and that requires user interaction, so it is not self-propagating. This is a real priority for patching because of the sandbox-escape RCE potential and Chrome's enormous footprint, but current evidence points to high potential rather than demonstrated active exploitation. No key signals directly conflict; the main gap is the absence of any POC or exploitation telemetry, so the 9.6 reflects worst-case impact rather than observed in-the-wild use.

An attacker hosts or compromises a web page containing a malicious PDF that triggers the use-after-free in Chrome's PDF component; a victim is lured into visiting it (UI:R). Because the flaw allows code execution outside the renderer sandbox (S:C), successful exploitation yields arbitrary code execution on the victim's host rather than just within the browser sandbox. No public exploit is identified at time of analysis, and low attack complexity means a working exploit would be reliable once developed.