EUVD-2026-50938
GHSA-2x7x-944v-v7q2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted PDF on web/email
-
DeliveryVictim opens PDF in Chrome
-
ExploitTrigger use-after-free in PDFium
-
ExecutionReuse dangling pointer for memory corruption
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or render an attacker-crafted PDF in a vulnerable Chrome build (< 151.0.7922.72) using Chrome's built-in PDFium viewer - this user interaction (CVSS UI:R) is the primary gating condition; no authentication or elevated privileges are needed (PR:N). Critically, code execution is contained WITHIN Chrome's renderer sandbox, so meaningful host compromise additionally requires chaining a separate sandbox-escape vulnerability that is out of scope for this CVE. Limiting factors: required user interaction, dependence on the in-browser PDF viewer, sandbox containment, and per SSVC the flaw is not automatable and shows no observed exploitation. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) reflects network reachability with low complexity, no privileges, but required user interaction (opening a PDF), and high confidentiality/integrity/availability impact on the affected component. These signals conflict in a meaningful way: Chromium's own security team rated the intrinsic severity 'Low', and CISA's SSVC framework records Exploitation: none and Automatable: no (though Technical Impact: total). The reconciling factor is the description's explicit note that code executes 'inside a sandbox' - a renderer-sandbox escape is NOT part of this CVE, so real-world impact is capped unless chained with a separate sandbox-escape bug. EPSS is not provided. Net assessment: patch-worthy as part of routine Chrome updates, but not an emergency - no active exploitation, no public PoC, no automatability, and sandbox containment substantially limits practical severity below what the 8.8 headline suggests. |
| Exploit ScenarioDerived | An attacker crafts a malicious PDF that triggers the PDFium use-after-free and hosts it on a web page or delivers it via email/link; when the victim opens the PDF in a vulnerable Chrome build (the required UI:R interaction), the dangling-pointer reuse corrupts memory and executes attacker-controlled code inside the renderer sandbox. No public exploit is identified at time of analysis, and without a separate sandbox-escape the attacker's foothold remains confined to the sandboxed renderer. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in Google Chrome's PDFium component (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code - confined to the renderer sandbox - when a victim opens a maliciously crafted PDF. The flaw is a CWE-416 use-after-free reported by Google's own Chrome team and fixed in the July 2026 Stable channel update; Chromium rated its intrinsic severity Low because execution is contained within the sandbox, though NVD's CVSS scores it 8.8. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the July 2026 Stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome typically auto-updates, so restart the browser to apply the pending update and verify the version under chrome://settings/help. Users of Chromium-based browsers should apply their vendor's build incorporating the equivalent PDFium fix. As an interim compensating control, avoid opening untrusted PDF files in-browser and route PDFs to a separate, patched/isolated viewer, or set Chrome to download rather than open PDFs (chrome://settings/content/pdfDocuments) - the trade-off is reduced convenience and users may open PDFs in another vulnerable application instead. Enterprises can enforce the update via Chrome Browser Cloud Management / group policy to guarantee timely rollout.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in PDFium, the open-source PDF rendering engine embedded in Chrome (and Chromium-derived browsers) that parses and displays PDF documents in-browser. The root cause is a use-after-free (CWE-416): PDFium continues to reference a heap object after it has been freed, so a crafted PDF can manipulate object lifetimes to cause a dangling pointer to be reused, corrupting memory in a controllable way. Because PDFium runs inside Chrome's renderer process, successful memory-corruption exploitation yields code execution only within that sandboxed process, not the host OS. The affected CPE is cpe:2.3:a:google:chrome:*, i.e. the desktop Chrome browser across platforms up to build 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted PDF with low complexity and no privileges but required user interaction to open it; scope unchanged as code stays within the sandboxed renderer with high C/I/A impact to that component.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a use-after-free vulnerability in the PDFium component (CVE-2026-18012, CVSS 8.8) enabling remote code execution when users open malicious PDFs. While execution is sandboxed, the HIGH severity rating reflects the ubiquity of PDF-based business workflows and Chrome's widespread deployment as an organizational standard. Organizations must patch immediately to close this common attack vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Implementation and Policy Flaws
View all 50Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB