Google Chrome EUVD-2026-116526

Exploitation requires the victim to open attacker-controlled content that Chrome renders through its PDFium PDF engine (a crafted HTML page embedding or loading a malicious PDF) on a Chrome build prior to 157.0.8103.38. No authentication is required (PR:N), but user interaction IS required (UI:R) - the target must navigate to or open the malicious page, so there is no fully passive drive-by against a closed browser. A key limiting factor is that the vulnerability yields code execution only 'inside the sandbox' per the vendor description; full host compromise would require chaining with an additional sandbox-escape vulnerability. Default Chrome configurations with PDFium enabled are affected.

This is a genuine high-priority patching item but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page, with high confidentiality, integrity, and availability impact - consistent with memory corruption leading to code execution. However, the description explicitly states code execution occurs 'inside the sandbox', so the practical impact is confined to the renderer process unless chained with a separate sandbox-escape, a limitation the raw 8.8 score does not capture. The decision signals temper urgency: SSVC reports Exploitation=none, Automatable=no (user interaction is required), and Technical Impact=total, and the vuln.today Decision label is 'this_week' - not act_now/emergency. The CVE is NOT in CISA KEV and no EPSS score was supplied. No working public exploit is referenced; the Chromium issue-tracker link (issues.chromium.org/567936263) is a restricted bug report, not exploit code. Net: a serious, widely-exposed browser RCE primitive that warrants prompt (this-week) patching, but current evidence shows no active exploitation and no confirmed public exploit, so it is a scheduled-priority fix rather than a drop-everything incident.

An unauthenticated remote attacker hosts or compromises a web page containing a malicious PDF rendered by Chrome's PDFium engine; when a victim navigates to it (the required user interaction), the use-after-free is triggered. Successful exploitation yields arbitrary code execution within the renderer sandbox, which would typically need to be chained with a separate sandbox-escape to fully compromise the host. No public exploit code is identified at time of analysis; the only tracker reference is a restricted Chromium bug entry, not a PoC.