Chrome EUVD-2026-13472

The victim must open a crafted PDF file in Google Chrome prior to version 146.0.7680.153. Remote unauthenticated attacker can deliver the malicious PDF via email, web download, or other means, but user interaction (opening the file) is required.

The Chromium security team assigned this vulnerability a High severity rating, indicating significant exploitability and impact potential. Although CVSS score and vector are not formally assigned in the provided data, the High severity classification combined with CWE-122 (heap overflow with direct memory corruption potential) suggests CVSS likely falls in the 8.0+ range with network-adjacent or network attack vector. The attack vector is network-based (remote delivery via PDF), and the attack complexity appears low given that standard PDF delivery mechanisms are sufficient. Exploitation is automatable since the attacker merely needs to deliver a crafted PDF; no user interaction beyond opening the file is implied. The technical impact is severe: heap corruption can lead to information disclosure, denial of service, or remote code execution. KEV (Known Exploited Vulnerability) status and proof-of-concept availability are not documented in the source data, suggesting either no public exploitation at the time of analysis or that exploitation remains theoretical. The availability of a vendor patch significantly reduces real-world risk for patched systems, but unpatched Chrome installations remain at high risk.

An attacker crafts a malicious PDF file containing specially formatted content designed to trigger a heap buffer overflow in PDFium's parsing routines. The attacker then distributes this PDF via email, a compromised website, or a drive-by download, and when a user opens it in an unpatched Chrome browser, the heap overflow is triggered. The memory corruption allows the attacker to overwrite adjacent heap structures, potentially hijacking control flow or leaking sensitive data. No public proof-of-concept is documented in the provided intelligence, but the low attack complexity and network delivery mechanism make exploitation feasible once technical details are reverse-engineered from patched binaries.