EUVD-2026-34766
GHSA-j4c6-r2j9-qvmh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted PDF
-
DeliveryVictim opens PDF in Chrome
-
ExploitPDFium parses malicious objects
-
ExecutionUse-after-free triggered on freed object
-
PersistHeap groom hijacks control flow
-
ImpactArbitrary code runs in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Victim must open or be served a crafted PDF file that Chrome renders via the built-in PDFium engine (UI:R in the CVSS vector), meaning either a direct navigation, an embedded <iframe>/<embed> of a PDF, or an opened PDF attachment. The vulnerable Chrome desktop build must be earlier than 149.0.7827.53, and the in-browser PDF viewer must not be disabled via the AlwaysOpenPdfExternally enterprise policy. Limiting factors: code execution is contained within the renderer sandbox (Scope:Unchanged), so full host compromise requires chaining a separate sandbox-escape vulnerability; SSVC marks the bug as not automatable, reflecting heap-grooming complexity inherent to UAF exploitation. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields a base score of 8.8, reflecting network reachability, no privileges, but required user interaction to open a crafted PDF. CISA's SSVC framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as 'total', which materially lowers operational urgency relative to the raw CVSS number. The vulnerability is not on the CISA KEV list and no public exploit identified at time of analysis; Google itself labels the Chromium security severity as Low, consistent with the fact that the code execution is contained within the renderer sandbox. EPSS data was not provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified here. Net assessment: standard browser-patching cadence is appropriate - not an emergency item absent evidence of in-the-wild exploitation, but worth shipping in the next browser update cycle because UAF bugs in PDFium are a historically attractive target for chaining with sandbox escapes. |
| Exploit ScenarioDerived | An attacker hosts a malicious PDF on an attacker-controlled site or embeds it in a phishing email and lures the victim to open it in Chrome; when PDFium parses the crafted document, the use-after-free is triggered and the attacker gains arbitrary code execution inside the renderer sandbox. From the sandboxed renderer the attacker can pivot to credential theft from same-origin contexts, deliver further drive-by payloads, or chain a separate sandbox-escape vulnerability to break out to the host OS. No public exploit identified at time of analysis, and SSVC rates the bug as not automatable, so realistic delivery would be a targeted lure rather than a mass worm. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Remote code execution in Google Chrome's PDFium component prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code within the renderer sandbox via a crafted PDF file. The flaw is a use-after-free memory corruption issue (CWE-416) requiring user interaction to open or render the malicious PDF, and no public exploit identified at time of analysis. Chromium rates the security severity as Low despite the CVSS 8.8 score, reflecting the sandbox containment of the resulting code execution.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade Chrome Stable to this version or later via the built-in updater or your managed-browser deployment tooling (consult the Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the upstream tracker at https://issues.chromium.org/issues/504545544). Enterprises managing fleets should force a relaunch to apply the update, since Chrome updates only become active after restart. As a compensating control while patching is in flight, disable the built-in PDF viewer by setting the AlwaysOpenPdfExternally policy so PDFs are downloaded rather than rendered in-browser - the trade-off is a degraded user experience and shifted risk to whichever external PDF handler users have installed. Network-side, content-inspection proxies can be configured to strip or sandbox inbound PDF attachments, though this will break legitimate workflows that rely on inline PDF delivery.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PDFium is the open-source PDF rendering engine embedded in Chromium-based browsers, responsible for parsing and displaying PDF documents directly in the browser tab. The root cause is CWE-416 (Use After Free), in which memory is referenced after it has been released back to the allocator, enabling an attacker who controls subsequent heap allocations to manipulate freed object contents and hijack control flow. Because PDFium runs inside Chrome's renderer process, successful exploitation is confined to the sandboxed renderer rather than the host operating system, unless chained with a separate sandbox escape. The affected CPE scope is Google Chrome desktop builds before 149.0.7827.53.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)
Executive ViewAI
Google Chrome prior to version 149.0.7827.53 contains a remote code execution vulnerability in its PDF rendering engine that can be exploited when users open a crafted PDF file. This exposes all Chrome users to potential compromise via email-delivered or web-hosted malicious PDFs. Organizations should prioritize patching all Chrome installations to protect against this widespread attack vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Security Fixes (149.0.7827.53)
View all 72Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB