EUVD-2026-100658
GHSA-j3w2-54w9-m7hw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
ExploitServe crafted PDF to PDFium
-
ExecutionTrigger heap buffer overflow in parser
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open attacker-controlled HTML/PDF content rendered by Chrome's embedded PDFium engine - i.e., user interaction (navigating to or opening a crafted page) is mandatory per UI:R, which limits mass/automated exploitation (SSVC Automatable=no). The affected feature is the default PDF-rendering component present in standard Chrome installations, so no non-default configuration is needed. Primary limiting factor: resulting code execution is confined to the renderer sandbox, so meaningful host compromise additionally requires a chained sandbox-escape vulnerability. Affected builds are Chrome prior to 155.0.8059.79 on desktop (stable and extended-stable channels). |
| Impact | Signals are largely consistent but point to a serious-yet-not-emergency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) describes a network-reachable, low-complexity, unauthenticated code-execution flaw requiring only that a user open a crafted HTML page. Critically, the description qualifies that arbitrary code executes INSIDE the sandbox - so without a separate sandbox-escape chain the practical impact is contained to the renderer process, which tempers the raw 8.8 score. The SSVC framework reinforces lower urgency: Exploitation=none (no observed in-the-wild activity), Automatable=no (requires per-target user interaction, so it cannot be mass-scanned/wormed), but Technical Impact=total. There is no CISA KEV listing and no POC referenced in the input, so per the exploitation rules this is 'no public exploit identified at time of analysis.' No EPSS score was provided, so probabilistic exploitation likelihood cannot be factored in - STATE EXPLICITLY: EPSS data is MISSING. Net: a real patch-now-soon browser bug (vendor patch available, Chromium 'High' severity) rather than a drop-everything emergency, because exploitation requires user interaction, is not automatable, and is sandbox-confined absent a chained escape. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page that serves a malicious PDF rendered by Chrome's built-in PDFium viewer. When a victim navigates to the page (UI:R), the crafted PDF triggers a heap buffer overflow (CWE-122) in PDFium, letting the attacker execute arbitrary code within the renderer sandbox. No public exploit code is identified at time of analysis, and full host compromise would additionally require a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A heap-based buffer overflow in PDFium, the PDF rendering engine embedded in Google Chrome, allows a remote attacker to achieve arbitrary code execution inside the browser's renderer sandbox by convincing a victim to open a crafted HTML page. All desktop Chrome builds prior to 155.0.8059.79 (stable and extended-stable channels) are affected, and exploitation requires user interaction (UI:R), which limits mass or automated abuse. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none; however, CISA assigns a total technical impact once the bug is triggered, and Google rates the Chromium security severity as High. The primary constraint on real-world impact is that code execution is confined to the renderer sandbox, so full host compromise would additionally require chaining a separate sandbox-escape vulnerability.
RemediationAI
Vendor-released patch: upgrade Google Chrome to version 155.0.8059.79 or later on the affected desktop platforms, as documented in the Chrome stable channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html) and the extended-stable channel advisory (https://chromereleases.googleblog.com/2026/10/extended-stable-update-for-desktop_0571684596.html). Chrome's update mechanism typically applies this automatically, but environments that pin browser versions or defer updates - including enterprises using update policies and extended-stable deployments - should verify the installed build number and force the update where auto-update is disabled. If immediate patching is not possible, reduce exposure by disabling Chrome's built-in PDF viewer (Settings > Privacy and security > Site settings > Additional content settings > PDF documents, or the AlwaysOpenPdfExternally enterprise policy) so PDF parsing is handled by a separately patched external reader rather than PDFium; the trade-off is the loss of in-browser PDF preview and a different, potentially weaker external attack surface. Additional compensating controls include blocking untrusted PDF/HTML downloads at the network or mail gateway and enforcing click-to-open behaviour, though neither is a substitute for upgrading since a sufficiently motivated attacker can still lure a user into opening a malicious page. There is no vendor-issued standalone patch for PDFium outside the Chrome release, so Chromium-based products bundling an older engine should track their own vendor's advisory for an equivalent fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-122 heap-based buffer overflow (CWE-122 maps directly to the tags 'Buffer Overflow' and 'Heap Overflow') in PDFium, the open-source PDF library that Google maintains and ships inside Chrome as the default PDF viewer. PDFium parses untrusted PDF and PDF-derived content, and in Chrome the engine is reachable automatically whenever a user navigates to a PDF or to HTML that embeds/triggers PDF parsing - meaning no non-default configuration or extension is required to expose the vulnerable code path. A heap buffer overflow of this class typically arises when a length or index derived from attacker-controlled input is used without adequate bounds validation during object parsing or rendering, allowing adjacent heap memory to be overwritten and, in the best case for the attacker, control-flow hijacking within the renderer process. Because the bug lives in the renderer, the attacker's code executes with renderer privileges inside Chrome's sandbox rather than directly on the host; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects network reachability, no privileges required, mandatory user interaction, and high confidentiality, integrity and availability impact to the sandboxed component. The product is tracked as PDFium/Chrome via Google's Chromium issue tracker entry 570167922 and the corresponding Chrome stable and extended-stable release advisories.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no privileges (AV:N/PR:N/AC:L) but requires the user to open it (UI:R); code runs in the sandbox without scope change (S:U) yet fully controls the renderer (C/I/A:H).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome desktop users across the organization are exposed to a high-severity PDFium flaw that could allow a crafted web page to execute code within the browser's renderer sandbox. While no public exploit has been identified and user interaction is required, widespread Chrome deployment and the potential for sandbox-escape chaining make timely patching a priority. Leadership should ensure all affected desktop Chrome instances are updated to 155.0.8059.79 or later to reduce risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB