Google Chrome CVE-2026-11305

Victim must open or be served a crafted PDF file that Chrome renders via the built-in PDFium engine (UI:R in the CVSS vector), meaning either a direct navigation, an embedded <iframe>/<embed> of a PDF, or an opened PDF attachment. The vulnerable Chrome desktop build must be earlier than 149.0.7827.53, and the in-browser PDF viewer must not be disabled via the AlwaysOpenPdfExternally enterprise policy. Limiting factors: code execution is contained within the renderer sandbox (Scope:Unchanged), so full host compromise requires chaining a separate sandbox-escape vulnerability; SSVC marks the bug as not automatable, reflecting heap-grooming complexity inherent to UAF exploitation.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields a base score of 8.8, reflecting network reachability, no privileges, but required user interaction to open a crafted PDF. CISA's SSVC framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as 'total', which materially lowers operational urgency relative to the raw CVSS number. The vulnerability is not on the CISA KEV list and no public exploit identified at time of analysis; Google itself labels the Chromium security severity as Low, consistent with the fact that the code execution is contained within the renderer sandbox. EPSS data was not provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified here. Net assessment: standard browser-patching cadence is appropriate - not an emergency item absent evidence of in-the-wild exploitation, but worth shipping in the next browser update cycle because UAF bugs in PDFium are a historically attractive target for chaining with sandbox escapes.

An attacker hosts a malicious PDF on an attacker-controlled site or embeds it in a phishing email and lures the victim to open it in Chrome; when PDFium parses the crafted document, the use-after-free is triggered and the attacker gains arbitrary code execution inside the renderer sandbox. From the sandboxed renderer the attacker can pivot to credential theft from same-origin contexts, deliver further drive-by payloads, or chain a separate sandbox-escape vulnerability to break out to the host OS. No public exploit identified at time of analysis, and SSVC rates the bug as not automatable, so realistic delivery would be a targeted lure rather than a mass worm.