EUVD-2026-35270
GHSA-66p7-vqr8-2m3v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted PDF on attacker site
-
DeliveryLure user via phishing or malvertising
-
ExploitVictim opens PDF in Chrome
-
ExecutionPDFium triggers use-after-free
-
PersistExecute arbitrary code in renderer sandbox
-
ImpactChain sandbox escape for host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must open or navigate to a crafted PDF file inside Google Chrome prior to 149.0.7827.103 with the built-in PDFium viewer active - this is the UI:R requirement in the CVSS vector. No authentication or prior access to the target system is needed (PR:N), and the attacker only needs a delivery channel that causes the PDF to render (direct link, embedded <embed>/<iframe>, email attachment opened in-browser). Limiting factors: code execution is confined to the renderer sandbox (S:U), so full host compromise requires chaining a separate sandbox-escape vulnerability; environments that have already disabled the internal PDF viewer (AlwaysOpenPdfExternally) or that block PDF delivery at the email/web gateway are not exposed via this path. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 8.8 (High): network-reachable, low complexity, no privileges, but user interaction required (opening or rendering the malicious PDF) and scope unchanged - execution is confined to the sandboxed renderer. No EPSS score, KEV listing, or SSVC decision was provided in the input, and no public exploit has been identified at time of analysis, so real-world exploitation pressure cannot be quantified from these signals alone. Chromium-rated High PDF use-after-frees historically attract n-day exploit development quickly once patches ship, so the practical risk window is narrow but real - particularly for enterprises that delay browser updates. Treat this as a prioritized patch item, but not an emergency override absent KEV or in-the-wild reports. |
| Exploit ScenarioDerived | An attacker hosts a crafted PDF on an attacker-controlled site or delivers it via email, phishing link, or a malvertising redirect, and lures the victim into opening it in Chrome. When PDFium parses the file, the use-after-free is triggered and the attacker gains arbitrary code execution inside the sandboxed renderer, which they would typically chain with a separate sandbox escape to compromise the host. No public exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Remote code execution in Google Chrome versions prior to 149.0.7827.103 stems from a use-after-free flaw in the PDF component, enabling a remote attacker who lures a user into opening a crafted PDF to execute arbitrary code within the renderer sandbox. Rated High by Chromium with CVSS 8.8, the issue requires user interaction but no authentication, and currently has no public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.103 - upgrade all desktop Chrome installations to this version or later via the Stable Channel update described at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html, and verify deployment by checking chrome://settings/help. For managed fleets, push the update via group policy or MDM and enforce a browser restart, since Chrome only completes the update after relaunch. As an interim compensating control while patches roll out, disable the built-in PDF viewer by setting the AlwaysOpenPdfExternally policy to true, which routes PDFs to an external handler - the trade-off is loss of in-browser PDF rendering and reliance on whatever external viewer handles the file, which may have its own vulnerabilities. Organizations using Chromium-derived browsers (Edge, Brave, Opera) should track and apply their respective vendor updates once they integrate the upstream PDFium fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's PDF subsystem, which is built on the PDFium library embedded within the browser. CWE-416 (Use After Free) describes a class of memory-safety bugs where code continues to reference memory after it has been freed, often allowing an attacker to control the contents of the freed object and hijack execution flow when the dangling pointer is dereferenced. Chrome runs PDF parsing inside a sandboxed renderer process, which constrains the immediate impact of code execution to that sandbox boundary; however, such bugs are commonly chained with a sandbox-escape primitive to achieve full system compromise. Affected products per vendor data are Google Chrome desktop builds before 149.0.7827.103.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in PDF in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 149.0.7827.103 contain a use-after-free vulnerability in the PDF handler that allows remote code execution if a user opens a malicious PDF file. All Chrome users enterprise-wide are at risk of arbitrary code execution on their devices; patching across the organization should be prioritized immediately to eliminate this attack vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB