EUVD-2026-79981
GHSA-cp3x-v679-m98x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but victim must open it (UI:R); code runs within the renderer sandbox so no scope change (S:U), with full memory-corruption impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
5DescriptionCVE.org
Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Remote code execution inside the renderer sandbox can be triggered in unpatched Google Chrome builds by a use-after-free in the browser's built-in PDF rendering component. Exploitation is unauthenticated (CVSS PR:N) but requires the victim to open a crafted HTML page that embeds malicious PDF content (UI:R), and any resulting code execution is confined to Chrome's renderer sandbox - meaning this bug alone does not compromise the host and would typically need to be chained with a separate sandbox-escape flaw for full system compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to load a crafted HTML page that embeds malicious PDF content, triggering the use-after-free in Chrome's PDF rendering component (UI:R - user interaction is mandatory). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine priority for any organization running Google Chrome, tempered by two limiting factors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Google Chrome to 153.0.8010.47 or later on all platforms (Windows, macOS, Linux), applying the stable channel update described at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html and confirming the build via chrome://version; the same fix should be tracked for Chromium-based downstream distributions that inherit Chromium's PDF code. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm the scope of exposure by inventorying Chrome versions across all managed endpoints and prioritizing any browser below 153.0.8010.47; push the vendor-released patch (Chrome 153.0.8010.47) to the highest-risk user groups first - executives, finance, and any staff who routinely open PDFs from external sources - and instruct users to relaunch Chrome so pending updates apply. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Use-after-free in the Workers component of Google Chrome allows an unauthenticated remote attacker to execute arbitrary
Use-after-free in Google Chrome's WebAppInstalls component allows a remote, unauthenticated attacker to execute arbitrar
Use after free in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap c
The Fonts implementation in Google Chrome before 40.0.2214.91 does not initialize memory for a data structure, which all
Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.91 allow attackers to cause a denial of service o
Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow
The SelectionOwner::ProcessTarget function in ui/base/x/selection_owner.cc in the UI implementation in Google Chrome bef
Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (out-of-bounds
Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the
Same weakness CWE-416 – Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today