Google Chrome EUVD-2026-34768

Exploitation requires the victim to open an attacker-controlled PDF file inside Chrome's built-in PDFium viewer - either by navigating to a page that embeds or auto-loads the PDF, or by opening a delivered file - which corresponds to the CVSS UI:R requirement. No authentication to the target is needed (PR:N), and the victim must be running Chrome Stable Desktop at a version below 149.0.7827.53 with the default in-browser PDF viewer enabled (deployments that have set AlwaysOpenPdfExternally or otherwise disabled PDFium handling are not exposed via this path). Impact is limited by Chrome's renderer sandbox (S:U), so without a chained sandbox escape the attacker's code execution is confined to the renderer process and cannot directly touch the host OS.

The signals here are mixed and warrant a nuanced reading. CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects unauthenticated network reachability with low complexity, but the UI:R requirement (the victim must open a malicious PDF) and the unchanged scope (S:U, meaning impact is bounded by the renderer sandbox) materially temper that score. CISA SSVC reports Exploitation: none and Automatable: no with Technical Impact: total, and no public exploit has been identified at time of analysis; Chromium itself rated the security severity as Low, which typically reflects that sandboxed renderer-only impact is judged less severe by Google. There is no KEV listing and no EPSS data provided in the input, so widespread opportunistic exploitation looks unlikely in the near term - the realistic risk is a targeted attacker who pairs this bug with a separate sandbox escape, which is a meaningful but not emergent threat for most enterprise browser fleets.

An attacker hosts a crafted PDF on a website or sends it as an email/chat attachment with a link; when the victim opens the PDF in Chrome, PDFium triggers the use-after-free during parsing and the attacker gains arbitrary code execution inside the Chrome renderer sandbox. To reach the host OS, the attacker would need to chain this with a separate sandbox escape, which is the typical pattern for browser-based targeted attacks. No public exploit has been identified at time of analysis, and CISA SSVC marks the issue as not automatable.