What is the CVSS score of CVE-2026-11304?

CVE-2026-11304 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11304?

A heap corruption vulnerability in Google Chrome's PDF viewer (PDFium) could allow attackers to execute code when users open malicious PDF files.. A patch is available.

How to fix or mitigate CVE-2026-11304?

Within 24 hours: Issue security advisory for CVE-2026-11304 and begin testing Google Chrome 149.0.7827.53 or later. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all user endpoints, prioritizing those handling external documents. Within 30 days: Verify 100% deployment completion across all systems and review security logs for any exploitation activity.

Google Chrome CVE-2026-11304

EUVD-2026-34765 HIGH

Use After Free (CWE-416)

2026-06-05 chrome-cve-admin@google.com

GHSA-w5f4-m5jq-x4xp

Denial Of Service Use After Free Memory Corruption Google Chrome

High

Disputed · 8.8 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 16:27 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

8.8 (None) 8.8 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Low)

AnalysisAI

Heap corruption in Google Chrome's PDFium component before version 149.0.7827.53 allows remote attackers to potentially execute arbitrary code by tricking a user into opening a crafted PDF file. The flaw is a use-after-free (CWE-416) carrying a CVSS 8.8 rating, though no public exploit identified at time of analysis and EPSS exploitation probability is negligible at 0.03% (11th percentile). Google rates the Chromium severity as Low despite the high CVSS, reflecting the requirement for user interaction and absence of observed exploitation.

Technical ContextAI

PDFium is the open-source PDF rendering engine embedded in Chromium-based browsers (Chrome, Edge, Brave, Opera) and is used to display PDF content directly in the browser tab without a separate plugin. The underlying flaw class, CWE-416 (Use After Free), occurs when code continues to reference heap memory after it has been freed, which an attacker can leverage by manipulating object lifecycles inside the PDF parser so that a freed object is reused with attacker-controlled data, leading to heap corruption and potential control-flow hijack. PDFium runs inside Chrome's sandboxed renderer process, so even successful memory corruption typically requires a second sandbox escape bug to achieve full code execution on the host, which the Chromium team often weighs when assigning their internal severity rating.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome to this version or later via the built-in updater (chrome://settings/help) or by redeploying the managed MSI/PKG in enterprise fleets, and verify Chromium-based downstream browsers (Edge, Brave, Opera) have picked up the corresponding rebase before considering the exposure closed; see the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the Chromium issue tracker entry at https://issues.chromium.org/issues/504418475. As a temporary workaround until patching, disable Chrome's built-in PDF viewer by setting the AlwaysOpenPdfExternally enterprise policy to true (which routes PDFs to download rather than rendering them in PDFium, at the cost of inline preview UX), or block untrusted PDF downloads at the web/email gateway; relying on the Chromium sandbox alone reduces but does not eliminate risk since paired sandbox-escape bugs are periodically disclosed.