EUVD-2026-100656
GHSA-v39c-6fgx-qpvp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML/PDF page
-
ExploitTrigger use-after-free in PDF component
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a crafted HTML page (with embedded PDF content) in an unpatched Chrome build prior to 155.0.8059.79 - this user interaction (UI:R) is the primary limiting factor, as the bug is not server-side or wormable on its own. A key additional limiter is that successful code execution is confined to Chrome's sandbox per the description; achieving full host compromise requires chaining an independent sandbox-escape vulnerability. No authentication is needed (PR:N), and default configurations are affected since the PDF viewer is enabled out of the box; patched versions (155.0.8059.79 and later, across Stable and Extended Stable channels) are not vulnerable. |
| Impact | This is a genuine but not emergency-grade priority. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - a realistic condition for browser drive-by attacks. However, the description explicitly states code execution occurs 'inside the sandbox,' meaning this renderer-level use-after-free (CWE-416) does NOT by itself yield host compromise; it would need to be chained with a separate sandbox-escape to achieve full RCE on the machine, which materially lowers standalone impact despite the high CVSS. The signals are internally consistent on low current real-world risk: CISA SSVC reports Exploitation: none and Automatable: no (though Technical Impact: total), there is no CISA KEV listing, and no public exploit was provided. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. Net: patch promptly because Chrome is ubiquitous and UAF bugs are historically chainable, but current evidence points to no active or automatable exploitation, so this is a standard-cadence browser update rather than a fire-drill. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing a malicious embedded PDF and lures a victim to open it in Chrome; the crafted PDF triggers a use-after-free in the PDF component, letting the attacker execute arbitrary code within the renderer/PDF sandbox. No public exploit code was identified at time of analysis, and the attacker would still need a separate sandbox escape to reach the underlying host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Use-after-free in Google Chrome's built-in PDF handling lets a remote attacker achieve arbitrary code execution inside the browser sandbox by getting a victim to open a crafted HTML page containing malicious PDF content, affecting all desktop Chrome builds prior to 155.0.8059.79. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and because the corrupted free happens in the renderer, code execution is contained by Chrome's sandbox - full host compromise would require chaining a separate sandbox-escape bug. CISA's SSVC assessment records no observed exploitation and no public exploit identified at time of analysis, so this is a genuine but not emergency-grade priority; Google rates the Chromium security severity as High and a vendor patch is available.
RemediationAI
Update Google Chrome to version 155.0.8059.79 or later - the exact vendor fix version for CVE-2026-110147 - using Chrome's built-in updater (Help > About Google Chrome) and restart the browser, since the patched binary only takes effect after a full relaunch; managed fleets should also pull the corresponding Extended Stable build referenced in the Extended Stable advisory (chromereleases.googleblog.com/2026/10/extended-stable-update-for-desktop_0571684596.html). Organizations that cannot patch immediately can reduce exposure by disabling the built-in PDF viewer via the 'Download PDF files instead of automatically opening them in Chrome' setting or the equivalent enterprise policy so that PDFs are never rendered in-process; the trade-off is degraded user experience and users may simply open the same file in another unpatched viewer. Blocking or filtering PDF content at the email gateway or proxy is also a partial compensating control, but any HTML page that triggers the PDF renderer can bypass simple file-type filtering, so lowering the attack surface this way is less reliable than patching. Standard Chrome hardening - keeping the sandbox enabled, restricting risky extensions, and maintaining up-to-date endpoint detection - does not remediate this bug but limits post-exploitation impact if code execution is achieved inside the sandbox. Reference advisories: chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html, chromereleases.googleblog.com/2026/10/extended-stable-update-for-desktop_0571684596.html, issues.chromium.org/issues/570050928, and nvd.nist.gov/vuln/detail/CVE-2026-110147.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, a use-after-free in the PDF component of Google Chrome. A dangling pointer to a heap object that has already been freed is reused while processing attacker-supplied PDF content, giving the attacker a controlled read/write primitive within the renderer process and ultimately arbitrary code execution. The affected code is reached through Chrome's built-in PDF viewer, which is enabled by default, so no extension, plugin, or special configuration is required - merely navigating to a crafted HTML page that embeds or triggers a PDF render. Per the description, the resulting execution is confined to Chrome's sandbox ('execute arbitrary code inside the sandbox'), which bounds the immediate blast radius: an attacker who gains renderer code execution still needs a second, independent sandbox-escape vulnerability to reach the host OS. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms remote network attackability, no privileges required, low attack complexity, and high confidentiality, integrity, and availability impact, with the sole prerequisite being that the victim opens the crafted page. Tags associated with this record include RCE, Denial Of Service, memory corruption, and use after free, consistent with the classic UAF-then-corrupt pattern seen in Chromium PDF fixes.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges (AV:N/PR:N) but requires the victim to open it (UI:R); impact stays high yet sandbox-confined, so scope unchanged (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome desktop users across the organization are affected by a high-severity remote code execution vulnerability in the browser's PDF handling component, present in all versions prior to 155.0.8059.79. Exploitation requires a user to open a malicious PDF, and while the code execution is contained within the browser sandbox, a successful attack could lead to full host compromise if chained with a separate sandbox-escape bug. With no public exploit identified at time of analysis and a vendor patch available, leadership should ensure rapid patching to mitigate this widely deployed risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB