What is the CVSS score of EUVD-2026-23054?

EUVD-2026-23054 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Chrome are affected by EUVD-2026-23054?

Google Chrome versions prior to 147.0.7727.101 contain a heap buffer overflow in the PDFium library that allows remote code execution within the browser sandbox when users open malicious PDF files.. A patch is available.

How to fix or mitigate EUVD-2026-23054?

Within 24 hours: Identify Chrome deployment scope across endpoints using asset management tools and verify current version baseline. Within 7 days: Deploy Chrome 147.0.7727.101 or later via your enterprise update mechanism (Google Admin Console for managed devices, or manual update notification for unmanaged instances) and confirm deployment completion on at least 95% of endpoints. Within 30 days: Achieve 100% deployment compliance through mandatory update policies and audit logs; simultaneously implement email gateway rules to flag or block executable PDFs from external sources as a layered defense measure.

Chrome EUVD-2026-23054

| CVE-2026-6306 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-04-15 Chrome

Heap Overflow Buffer Overflow RCE Google Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 16, 2026 - 10:22 vuln.today

CVSS changed

Apr 16, 2026 - 10:22 NVD

8.8 (HIGH)

Patch released

Apr 15, 2026 - 19:46 nvd

Patch available

EUVD ID Assigned

Apr 15, 2026 - 19:45 euvd

EUVD-2026-23054

Analysis Generated

Apr 15, 2026 - 19:45 vuln.today

CVE Published

Apr 15, 2026 - 19:04 nvd

HIGH 8.8

DescriptionCVE.org

Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)

AnalysisAI

Heap buffer overflow in Google Chrome's PDFium library (versions prior to 147.0.7727.101) enables remote code execution within the Chrome sandbox when a victim opens a malicious PDF file. Despite CVSS 8.8 severity, exploitation requires user interaction (opening a crafted PDF) and is confined to the sandbox, limiting system-level impact. Vendor patch available in Chrome 147.0.7727.101. No active exploitation confirmed (not in CISA KEV), no public POC identified at time of analysis. EPSS data not provided.

Technical ContextAI

PDFium is Google Chrome's open-source PDF rendering engine, responsible for parsing and displaying PDF content within the browser. This vulnerability stems from a CWE-122 heap-based buffer overflow, where insufficient bounds checking during PDF parsing allows writing beyond allocated memory boundaries. The overflow occurs when processing maliciously crafted PDF structures, potentially corrupting heap metadata or adjacent memory objects. Affected product per CPE: Google Chrome all versions prior to 147.0.7727.101 across all platforms (Windows, macOS, Linux, ChromeOS). Heap overflows in complex parsers like PDFium are particularly dangerous because they can be leveraged to achieve arbitrary code execution by carefully controlling heap layout and overwriting function pointers or vtables. However, Chrome's multi-process architecture and sandbox confine PDFium to a restricted renderer process with limited OS privileges.

RemediationAI

Update Google Chrome to version 147.0.7727.101 or later immediately via built-in auto-update (chrome://settings/help) or manual download from official Google channels per advisory at http://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html. For enterprise deployments, push Chrome 147.0.7727.101 via managed update policies (Google Admin Console, SCCM, Intune). Interim compensating controls if patching is delayed: disable PDF rendering in Chrome via chrome://settings/content/pdfDocuments and configure external PDF viewers (Adobe Acrobat, system default) - trade-off is reduced user convenience and potential exposure if external viewer has vulnerabilities. Block PDF email attachments at email gateway and restrict PDF downloads to trusted domains via web proxy/firewall rules - reduces attack surface but may impact legitimate workflows. Do not rely on sandbox as sole protection, as sandbox escapes combined with this RCE could achieve full system compromise. Verify patch deployment via chrome://version showing 147.0.7727.101 or higher.