Google Chrome CVE-2026-118345

Exploitation requires the victim to render a crafted HTML page that drives Chrome's built-in PDFium PDF engine (UI:R - user interaction such as visiting an attacker-controlled page is mandatory); it is remote and unauthenticated (PR:N) against default Chrome configurations prior to 156.0.8078.73, since PDFium is a standard bundled component. The key LIMITING factor is that resulting code execution is confined to the renderer sandbox per the vendor description - achieving full host compromise would require chaining an additional sandbox-escape vulnerability, which is not part of this CVE. The specific memory-management trigger within PDFium is not described in the available sources.

This is a genuine high-priority browser vulnerability, though not an emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity flaw that requires no privileges but does require user interaction (visiting or rendering a crafted page). Google assigns a 'High' Chromium severity and a patch is available, and the vuln.today decision label is 'this_week' - consistent with prompt, not emergency, remediation. Critically, the description states code execution occurs 'inside the sandbox,' meaning successful exploitation yields code execution in the constrained PDFium/renderer process and would still require a separate sandbox-escape to achieve full host compromise; the CVSS C:H/I:H/A:H reflects renderer-context impact (scope Unchanged), not root on the machine. No EPSS score was provided, so statistical exploitation likelihood cannot be quantified. The vulnerability is NOT listed in CISA KEV and there is no public exploit identified at time of analysis - the chromium issue tracker reference (issues.chromium.org/574061024) is a restricted-access bug entry, not a working PoC. Net: a real, broadly-exposed memory-corruption bug in ubiquitous software that should be patched promptly, but there is no evidence of active exploitation or public weaponization at this time.

An attacker hosts a malicious web page containing a crafted PDF document that triggers a use-after-free in Chrome's PDFium component when rendered. A victim with a vulnerable Chrome version (prior to 156.0.8078.73) visits the page, and the freed-object reuse is leveraged to execute attacker-controlled code within the renderer sandbox. No public exploit is identified at time of analysis, and full system compromise would additionally require a sandbox escape.