What is the CVSS score of CVE-2026-11305?

CVE-2026-11305 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11305?

Google Chrome prior to version 149.0.7827.53 contains a remote code execution vulnerability in its PDF rendering engine that can be exploited when users open a crafted PDF file.. A patch is available.

How to fix or mitigate CVE-2026-11305?

Within 24 hours: Audit Chrome version distribution across endpoints and prepare patch deployment notifications. Within 7 days: Deploy Chrome version 149.0.7827.53 or later to all affected systems, prioritizing users with frequent exposure to external documents. Within 30 days: Verify patch compliance across all Chrome installations and implement monitoring for any exploitation attempts.

Google Chrome CVE-2026-11305

EUVD-2026-34766 HIGH

Use After Free (CWE-416)

2026-06-05 chrome-cve-admin@google.com

GHSA-j4c6-r2j9-qvmh

Google Memory Corruption RCE Use After Free Denial Of Service Chrome

High

Disputed · 8.8 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:15 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome's PDFium component prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code within the renderer sandbox via a crafted PDF file. The flaw is a use-after-free memory corruption issue (CWE-416) requiring user interaction to open or render the malicious PDF, and no public exploit identified at time of analysis. Chromium rates the security severity as Low despite the CVSS 8.8 score, reflecting the sandbox containment of the resulting code execution.

Technical ContextAI

PDFium is the open-source PDF rendering engine embedded in Chromium-based browsers, responsible for parsing and displaying PDF documents directly in the browser tab. The root cause is CWE-416 (Use After Free), in which memory is referenced after it has been released back to the allocator, enabling an attacker who controls subsequent heap allocations to manipulate freed object contents and hijack control flow. Because PDFium runs inside Chrome's renderer process, successful exploitation is confined to the sandboxed renderer rather than the host operating system, unless chained with a separate sandbox escape. The affected CPE scope is Google Chrome desktop builds before 149.0.7827.53.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade Chrome Stable to this version or later via the built-in updater or your managed-browser deployment tooling (consult the Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the upstream tracker at https://issues.chromium.org/issues/504545544). Enterprises managing fleets should force a relaunch to apply the update, since Chrome updates only become active after restart. As a compensating control while patching is in flight, disable the built-in PDF viewer by setting the AlwaysOpenPdfExternally policy so PDFs are downloaded rather than rendered in-browser - the trade-off is a degraded user experience and shifted risk to whichever external PDF handler users have installed. Network-side, content-inspection proxies can be configured to strip or sandbox inbound PDF attachments, though this will break legitimate workflows that rely on inline PDF delivery.