EUVD-2026-34764
GHSA-cwjx-7rhw-fgp9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconHost crafted PDF on attacker site
-
DeliveryPhish victim into opening URL
-
ExploitChrome loads PDF in PDFium
-
InstallTrigger use-after-free in object parser
-
C2Execute shellcode in renderer sandbox
-
ExecuteChain with sandbox escape
-
ImpactCompromise host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Victim must open an attacker-supplied crafted PDF file inside Google Chrome (or a Chromium-derivative) at a version below 149.0.7827.53, with PDFium handling the document - the default behavior for the built-in PDF viewer. Required user interaction (CVSS UI:R) limits drive-by automation: the user must navigate to the PDF URL or open the attachment. Exploitation is further limited because code execution lands inside Chrome's renderer sandbox, so a separate sandbox-escape vulnerability is needed to reach the underlying OS. No authentication is required on the attacker side (PR:N), and no special victim-side configuration is needed beyond the default Chrome PDF viewer being enabled. |
| Impact | The CVSS 3.1 score of 8.8 reflects network attack vector, low complexity, no privileges, but required user interaction (UI:R) - a user must open the malicious PDF. SSVC contradicts the raw CVSS prioritization: exploitation is rated 'none' (no observed activity), automatable is 'no' (user interaction breaks automation), while technical impact is 'total' if exploited. Chromium's own internal severity rating is 'Low', further suggesting the bug is hard to weaponize reliably or yields limited primitives inside the sandbox. No EPSS score was provided in the input, the CVE is not on CISA KEV, and no POC is referenced, so realistic priority is moderate - patch in normal cadence rather than emergency, as sandboxed RCE in a browser is a known stepping-stone but not a standalone compromise. |
| Exploit ScenarioDerived | An attacker hosts a crafted PDF on a web page or sends it as an email attachment with a link, then lures a target via phishing or watering-hole compromise. When the victim opens the PDF in Chrome, PDFium triggers the use-after-free during object parsing, giving the attacker code execution inside the renderer sandbox - typically used as the first stage of an exploit chain paired with a separate sandbox escape to achieve full host compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the PDFium component that parses PDF documents. A remote attacker who lures a user into opening a crafted PDF can execute arbitrary code, though execution is contained within Chrome's renderer sandbox. No public exploit is identified at time of analysis, and SSVC indicates no observed exploitation.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade desktop installations to this stable channel build or later via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators should push the update through Group Policy, Jamf, Intune, or equivalent management tooling and force a browser restart to load the patched PDFium binary. As a temporary compensating control until rollout completes, disable Chrome's built-in PDF viewer by setting the 'AlwaysOpenPdfExternally' enterprise policy to true (trade-off: PDFs download instead of rendering inline, which degrades user experience but removes the PDFium attack surface), or block PDF email attachments at the gateway (trade-off: impacts legitimate business workflows). Users of Chromium-derivative browsers should track their vendor's matching release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PDFium is the open-source PDF rendering engine embedded in Chromium-based browsers and is responsible for parsing, rasterizing, and interpreting PDF objects when a user opens a document in the browser. CWE-416 (Use After Free) indicates that memory referencing a freed PDF object is subsequently dereferenced, enabling an attacker who controls the freed allocation to redirect execution flow or corrupt adjacent heap state. Because PDFium runs inside Chrome's renderer process, successful exploitation yields code execution constrained by the renderer sandbox boundary, meaning a second sandbox-escape primitive would be required to reach the host OS.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions prior to 149.0.7827.53 contain a remote code execution vulnerability in the PDF parser affecting any organization where users handle external PDF files. No public exploit identified at time of analysis. While the vulnerability is mitigated by Chrome's renderer sandbox, this patching requirement should be prioritized to eliminate an active attack vector in enterprise browser deployments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Security Fixes (149.0.7827.53)
View all 72Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB