Google Chrome CVE-2026-93381

Exploitation requires a victim running Google Chrome on Windows prior to 153.0.8010.52 to open an attacker-crafted PDF (UI:R social engineering) so that PDFium parses the malicious document and triggers the heap overflow. Key limiting factors: mandatory user interaction to open the crafted PDF, and - critically - the resulting code execution is confined to the Chrome renderer sandbox, meaning host compromise additionally requires a separate sandbox-escape vulnerability not covered here. No authentication is required (PR:N), and default Chrome configurations render PDFs, so no special feature toggle is needed beyond opening the file.

The vendor CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting a network-reachable, low-complexity heap buffer overflow (CWE-122) in PDFium requiring only user interaction. However, the description explicitly states code execution occurs INSIDE the Chrome sandbox (S:U, no scope change), so full host compromise requires an additional, separate sandbox-escape vulnerability that this CVE does not provide - materially lowering real-world impact versus the raw 8.8. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so exploitation status is: no public exploit identified at time of analysis. UI:R (social engineering to open a crafted PDF) further gates exploitation and argues against automatable, wormable mass exploitation. Net: a genuine High-severity renderer memory-corruption bug in an ubiquitous product, but one trending toward the lower end of High for practical risk absent a chained escape and given no evidence of active exploitation. Note the input Tags include 'Microsoft', which is incorrect - the affected product is Google Chrome (Windows is merely the platform).

An attacker crafts a malicious PDF that triggers the PDFium heap buffer overflow and uses social engineering (e.g., a phishing link or email attachment) to convince a victim to open it in Chrome on Windows. Successful exploitation yields arbitrary code execution confined to the renderer sandbox; the attacker would then need a separate sandbox-escape bug to reach the host. No public proof-of-concept or exploit code is identified in the available data.