EUVD-2026-50624
GHSA-gq67-349v-hv27
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted PDF via web or email
-
DeliveryVictim opens PDF in vulnerable Chrome
-
ExploitTrigger use-after-free in PDFium
-
ExecutionCorrupt heap and hijack control flow
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or render a crafted PDF file in a Chrome build prior to 151.0.7922.72 using the PDFium engine (UI:R - user interaction is mandatory, e.g. clicking/viewing the malicious PDF). No authentication and no special privileges are needed (PR:N), and the attack is network-deliverable (AV:N/AC:L) via any channel that gets the PDF in front of the user. Limiting factors: successful code execution is contained within Chrome's renderer sandbox, so real-world host compromise additionally requires a separate sandbox-escape vulnerability; disabling in-browser PDF rendering removes the trigger path. |
| Impact | The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) reflects a network-reachable, low-complexity, unauthenticated attack that nonetheless requires user interaction (opening/viewing a malicious PDF). Counterbalancing signals lower the practical priority: EPSS is only 0.21% (11th percentile), there is no CISA KEV listing (no confirmed active exploitation), and no public exploit code has been identified. Critically, the description states code executes 'inside a sandbox' - Chrome's renderer sandbox contains the impact, so the C:H/I:H/A:H rating describes worst-case in-sandbox impact rather than full host takeover, which would require chaining a separate sandbox escape. Google/Chromium themselves rated the severity Medium, consistent with the sandbox containment, even though the numeric CVSS lands in the High band. Net: this is a routine-but-real browser memory-safety bug that should be patched via normal Chrome update cadence rather than treated as an emergency, absent evidence of exploitation. |
| Exploit ScenarioDerived | An attacker hosts a crafted PDF on a website or sends it as an email attachment/link; when the victim opens or previews the PDF in a vulnerable Chrome build, PDFium's use-after-free is triggered, allowing the attacker to execute code within the renderer sandbox. Low attack complexity means reliable triggering, but user interaction (viewing the PDF) is required and the payload is confined to the sandbox absent a chained escape. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in Google Chrome's PDFium PDF rendering engine (versions prior to 151.0.7922.72) allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox via a crafted PDF file. The flaw is a CWE-416 use-after-free rated CVSS 8.8 (Chromium-assessed severity: Medium) and requires the victim to open or render a malicious PDF (UI:R). No public exploit has been identified at time of analysis and the EPSS score is low (0.21%, 11th percentile), and code execution is confined to the sandbox, meaning a separate sandbox-escape chain would be needed for full host compromise.
RemediationAI
Vendor-released patch: update Google Chrome to version 151.0.7922.72 or later on all desktop platforms; Chrome typically auto-updates, so ensure the browser is restarted to apply the fix, and verify via chrome://settings/help. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If patching cannot be completed immediately, compensating controls include disabling Chrome's built-in PDF viewer (set PDFs to download rather than open in-browser via chrome://settings/content/pdfDocuments) so crafted PDFs are not auto-rendered by PDFium - trade-off is reduced usability for legitimate inline PDFs; and blocking or sandboxing untrusted PDF delivery at the email/web gateway. Enterprise fleets should push the update via managed update policy and enforce Site Isolation (default) to keep the renderer sandbox intact as a defense-in-depth layer.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PDFium is the open-source PDF rendering library embedded in Chromium/Google Chrome that parses and renders PDF documents within the renderer process. The root cause is a use-after-free (CWE-416): a memory object is freed while a dangling reference to it remains, and subsequent access to that reference can be manipulated by a crafted PDF to corrupt heap memory and hijack control flow. Because PDFium runs inside Chrome's renderer sandbox, successful exploitation grants code execution only within that sandboxed context. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e. the Chrome desktop (Stable channel) prior to the fixed build 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered PDF (AV:N/AC:L) with no auth (PR:N) but requiring the user to open it (UI:R); in-sandbox code execution still yields high C/I/A within that scope (S:U).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a memory safety vulnerability in its PDF rendering engine that allows remote code execution when users open malicious PDF files. No public exploit has been identified at time of analysis, and code execution remains confined to the browser's sandbox, substantially limiting the risk of full system compromise. With a vendor patch available and low exploitation probability (0.21% EPSS), this vulnerability can be effectively mitigated through standard patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB