EUVD-2026-105480
GHSA-hjj4-c52h-9746
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML/PDF page
-
ExploitDeliver malformed PDFium content
-
ExecutionTrigger memory corruption in parser
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open attacker-controlled web content that is rendered by Chrome's built-in PDFium PDF engine (UI:R - user interaction via visiting a crafted HTML page). No authentication or elevated privileges are required (PR:N). The key LIMITING factor is sandbox containment: per the description, code execution occurs inside the renderer sandbox, so a successful exploit must be chained with a separate sandbox-escape vulnerability to compromise the host OS or user data outside the browser. Affected deployments are any Chrome desktop build prior to 156.0.8078.47; updating to 156.0.8078.47 or later remediates the issue. |
| Impact | Signals are mixed and must be weighed carefully. The NVD CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U, indicating a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - a very achievable condition for a browser. However, Google's own Chromium severity rating is Medium, and the description explicitly states code execution occurs INSIDE the sandbox, meaning this is a renderer-level compromise that does not by itself escape to the host OS; a separate sandbox-escape bug would be needed for full system compromise. This conflict between NVD's 8.8/High and the vendor's Medium is the single most important nuance: the 8.8 does not model the sandbox containment, so real-world severity is likely lower than the raw score suggests. No EPSS score, KEV listing, or POC indicator was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a patch-promptly browser bug (ubiquitous product, no user privileges needed), but it is not a drop-everything emergency absent a paired sandbox escape - treat it as routine high-priority Chrome patching rather than an actively exploited zero-day. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malformed PDF content that is rendered by Chrome's PDFium component. When a victim using a vulnerable Chrome build (prior to 156.0.8078.47) visits the page, the crafted data triggers memory corruption and can lead to arbitrary code execution confined to the renderer sandbox. No public exploit was identified in the provided data, and the attacker must still chain a separate sandbox escape to affect the underlying host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in PDFium, Chrome's built-in PDF engine, lets a remote attacker potentially execute arbitrary code inside the renderer sandbox on desktop Chrome builds prior to 156.0.8078.47 when a victim opens a crafted HTML page that triggers PDF rendering. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and because execution is confined to the sandbox, full host compromise would require chaining with a separate sandbox-escape bug. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build; note the scoring split between NVD's 8.8 and Chromium's own Medium severity, which reflects the sandbox containment.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later - the fix ships in the stable channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Trigger the update through chrome://settings/help (or the enterprise/package-manager equivalent such as Chrome for Enterprise MSI/PKG or your Linux distribution's chrome-stable package) and fully restart the browser, since a restart is required for the new renderer binary to take effect; verify the version on chrome://version afterward. If patching must be deferred, reduce exposure by disabling Chrome's built-in PDF viewer so PDFs are downloaded instead of rendered - via Settings → Privacy and security → Site settings → PDF documents, or the enterprise policy AlwaysOpenPdfExternally - at the cost of losing in-browser PDF preview and embedded PDF functionality, and treat this as a stopgap because the underlying PDFium code remains vulnerable. Additional compensating controls include restricting browsing to trusted sites through URL blocklisting/allowlisting policies, blocking untrusted PDF and HTML downloads at the network gateway, and keeping Site Isolation enabled (default) so renderer compromise stays contained; note that none of these remove the vulnerability, and because exploitation stays inside the sandbox, host-level impact would still require a separate sandbox escape. Monitor the Chromium issue and Chrome release blog for any follow-up updates or backported fixes for older channels.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PDFium is the open-source PDF parsing and rendering library embedded in Chromium and therefore in Google Chrome; it processes PDF content both in dedicated PDF views and in embedded contexts reached from ordinary HTML pages. The flaw is classified CWE-119 (improper restriction of operations within the bounds of a memory buffer), meaning malformed PDF objects cause the parser/renderer to read or write outside an allocated buffer, corrupting memory in a way that can potentially be shaped into controlled code execution. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity attack that only requires the victim to load attacker-controlled content, with high confidentiality and integrity impact scored within the same security authority (S:U) - here the renderer process. Google's own rating of Medium, versus NVD's 8.8, reflects that the corruption is contained by Chrome's renderer sandbox, so a standalone exploit yields code execution inside the sandbox rather than on the host; crossing that boundary requires an independent sandbox-escape vulnerability. The affected component is the PDFium code shipped in Chrome desktop releases prior to 156.0.8078.47, tracked in Chromium issue 494352583.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted page with no privileges (AV:N/PR:N) but victim must open it (UI:R); scope unchanged as impact is confined to the sandboxed renderer, which itself handles high-value browsing data (S:U, C/I/A:H).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop builds prior to 156.0.8078.47 carry a high-severity memory corruption flaw in the built-in PDFium PDF engine, which an attacker can trigger by convincing a user to open a crafted web page that renders a malicious PDF. Because the resulting code execution is confined to Chrome's renderer sandbox, a full endpoint compromise would require chaining a second, separate sandbox-escape vulnerability, so the realistic near-term risk is browser-level rather than full host takeover. Leadership should care because the exposure footprint is essentially the entire desktop browser fleet, no credentials are needed, and remediation depends on how quickly the organization can push a Chrome build update across all user populations, including remote and unmanaged-adjacent devices.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB