What is the CVSS score of EUVD-2026-34768?

EUVD-2026-34768 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-34768?

Google Chrome's PDFium PDF processing component contains a remote code execution vulnerability (CVE-2026-11307, CVSS 8.8) triggered when users open a crafted PDF document, affecting all Chrome users…. A patch is available.

How to fix or mitigate EUVD-2026-34768?

Within 24 hours: Issue communication to all Chrome users recommending they avoid opening PDF files from untrusted sources. Within 7 days: Deploy Chrome 149.0.7827.53 or later across all endpoints using your patch management system. Within 30 days: Audit Chrome version compliance and block versions older than 149.0.7827.53 from accessing internal PDF repositories.

Google Chrome EUVD-2026-34768

| CVE-2026-11307 HIGH

Use After Free (CWE-416)

2026-06-05 chrome-cve-admin@google.com

GHSA-jjwj-47j7-vgx9

RCE Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:14 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome's PDFium component prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code within the renderer sandbox by enticing a user to open a crafted PDF file. The flaw is a use-after-free memory corruption issue (CWE-416) carrying a CVSS 8.8 rating, though Chromium rated its security severity as Low and no public exploit has been identified at time of analysis. User interaction is required, and code execution is constrained to the Chrome sandbox absent a chained sandbox escape.

Technical ContextAI

PDFium is the open-source PDF rendering engine embedded in Chromium-based browsers, responsible for parsing and displaying PDF documents directly in the browser tab. The vulnerability is a use-after-free (CWE-416), a memory-safety defect where the program continues to reference heap memory after it has been deallocated; attackers craft input that triggers the dangling reference and then reclaim the freed region with attacker-controlled data, leading to control over a function pointer or vtable and ultimately arbitrary code execution. Because PDFium runs inside Chrome's renderer process, successful exploitation gains code execution within the renderer sandbox rather than directly on the host operating system.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 on the Stable Desktop channel - update Chrome to 149.0.7827.53 or later via the built-in updater or managed deployment tooling (chrome://settings/help), referencing the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Administrators of Chromium-derived browsers should track their vendor's release notes for an equivalent PDFium update and apply it as soon as it ships. Until patches are deployed, compensating controls include disabling Chrome's built-in PDF viewer by setting the AlwaysOpenPdfExternally enterprise policy to true so PDFs are downloaded rather than rendered in PDFium (trade-off: degraded UX and shifts risk to whichever external PDF reader is configured), or blocking PDF downloads from untrusted origins at the web proxy (trade-off: breaks legitimate workflows that depend on inline PDF delivery). Generic browser hardening such as enforcing Site Isolation and keeping the renderer sandbox intact remains relevant since exploitation is currently bounded by the sandbox.