EUVD-2026-23088Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Matches vendor vector; AC:H and UI:R reflect required UI gestures; S:C captures PDFium-to-renderer scope change, though C/I/A:H overstates post-sandbox impact.
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
Heap buffer overflow in PDFium in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)
AnalysisAI
Heap buffer overflow in PDFium, Chrome's embedded PDF rendering library, allows remote attackers to execute arbitrary code within Chrome's renderer sandbox on Windows systems prior to version 147.0.7727.101. Exploitation requires convincing a user to open a crafted PDF file and perform specific UI gestures - raising real-world bar beyond passive drive-by. Code execution is confined to the renderer sandbox, meaning a full system compromise would require a separate sandbox escape. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS sits at 0.01% (3rd percentile), reflecting low current exploitation probability.
Technical ContextAI
PDFium is Google's open-source PDF rendering engine, derived from Foxit SDK and integrated directly into Chrome as its default PDF viewer. The vulnerability is a CWE-122 heap-based buffer overflow, a classic memory corruption class where attacker-controlled data is written past the end of a heap allocation. In Chrome's multi-process architecture, PDFium executes inside a sandboxed renderer process, meaning code execution achieved via this flaw does not directly reach the operating system or kernel - a follow-on sandbox escape primitive would be required for broader impact. Affected CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for versions prior to 147.0.7727.101, restricted to the Windows platform per the advisory.
RemediationAI
Vendor-released patch: Chrome 147.0.7727.101 for Windows. Update Chrome via Settings → Help → About Google Chrome, or allow Chrome's automatic update mechanism to apply the patch (the update will install on browser restart). Enterprise deployments should push the update through Google Admin Console or equivalent MDM tooling. As a short-term workaround for environments that cannot immediately update, disabling Chrome's built-in PDF viewer (chrome://settings/content/pdfDocuments, set to 'Download PDFs') forces PDFs to open in an external viewer, eliminating the PDFium attack surface at the cost of user convenience. Blocking delivery of PDF attachments at email/web gateway is a compensating control but does not address PDFs loaded from arbitrary web content. Advisory: chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html.
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Same weakness CWE-122 – Heap-based Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: HighShare
External POC / Exploit Code
Leaving vuln.today