EUVD-2026-34767
GHSA-h46q-9c5h-x87h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious PDF
-
DeliveryHosts on web page or delivers via link
-
ExploitVictim opens PDF in Chrome
-
ExecutionPDFium triggers use-after-free
-
PersistAttacker executes code in renderer sandbox
-
Impact(Optional) chain sandbox escape for host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Victim must use Google Chrome prior to 149.0.7827.53 and open or render a crafted PDF file through PDFium - typically by visiting an attacker-controlled web page that serves the PDF inline, opening an emailed PDF in the browser, or clicking a PDF link (UI:R in the CVSS vector confirms user interaction is required). No authentication or prior access to the victim system is needed (PR:N). Exploitation is limited by Chrome's renderer sandbox (Scope:Unchanged), so arbitrary code execution is contained to the sandboxed renderer process unless chained with a separate sandbox escape; users who disable the built-in PDF viewer (AlwaysOpenPdfExternally policy) are not exposed to this PDFium code path. |
| Impact | The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-reachable, low-complexity, unauthenticated exploitation requiring user interaction, with high impact across the CIA triad. However, signals diverge: Google's Chromium team rated severity as 'Low' (sandbox-contained), and CISA SSVC reports Exploitation: none and Automatable: no, while Technical Impact is total. There is no EPSS data provided and no KEV listing, and no public exploit identified at time of analysis. The realistic risk is moderate rather than critical - exploitation yields code execution inside the renderer sandbox, which requires a separate sandbox escape to fully compromise the host. Defenders should patch promptly given Chrome's broad attack surface and history of PDFium bugs being chained, but emergency response is not warranted absent active exploitation evidence. |
| Exploit ScenarioDerived | An attacker hosts a malicious PDF on a controlled website or embeds it in an iframe/ad network, then lures a victim using vulnerable Chrome to visit the page; PDFium parses the crafted PDF, triggers the use-after-free, and the attacker gains code execution inside Chrome's renderer sandbox. To achieve full host compromise the attacker would need to chain a separate sandbox-escape vulnerability. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the PDFium component, allowing a remote attacker to execute arbitrary code within the renderer sandbox by serving a crafted PDF file. While exploitation is constrained to the sandbox and requires user interaction (visiting a page or opening a PDF), the CVSS score of 8.8 reflects the high impact on confidentiality, integrity, and availability if combined with a sandbox escape. No public exploit identified at time of analysis, and CISA SSVC indicates exploitation status of 'none'.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.53 (Stable channel). Update Chrome immediately to 149.0.7827.53 or later via the built-in updater (chrome://settings/help) or by redeploying through enterprise management tooling (Group Policy, MDM, Chrome Browser Cloud Management). Verify Chromium-derived browsers (Edge, Brave, Opera) have integrated the upstream PDFium fix before considering them patched. Compensating controls while patching: disable the built-in PDF viewer via the AlwaysOpenPdfExternally policy so PDFs download rather than render in PDFium (trade-off: degrades user experience and shifts risk to the external PDF handler), or block inline PDF rendering at the web proxy by stripping/quarantining application/pdf content (trade-off: breaks legitimate workflows). Reference: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PDFium is the open-source PDF rendering engine embedded in Chromium-based browsers (Chrome, Edge, Brave, Opera) to parse and display PDF files inline. The vulnerability is CWE-416 (Use After Free), a memory-safety class where an object is freed but a dangling pointer to it is later dereferenced, enabling attackers to potentially read freed memory, corrupt heap structures, or hijack control flow. PDFium has historically been a frequent source of Chrome browser vulnerabilities due to the complexity of the PDF format and its parsing of untrusted content, and Google's own classification rates this issue as 'Low' severity at the Chromium level - likely because exploitation occurs inside the renderer sandbox rather than escaping it.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)
Executive ViewAI
Google Chrome contains a critical remote code execution vulnerability (CVE-2026-11306) in its PDF rendering engine affecting all users with older Chrome versions; attackers could execute arbitrary code by serving malicious PDFs, potentially enabling credential theft and data exfiltration. While exploitation requires user interaction and is constrained to the renderer sandbox, the high impact and ubiquity of Chrome across employee endpoints makes this a significant organizational risk. Immediate patching to Chrome 149.0.7827.53 or later is essential to prevent potential breach scenarios.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Security Fixes (149.0.7827.53)
View all 72Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB