Google Chrome EUVD-2026-82478

Requires user interaction (UI:R): the victim must open or navigate to a crafted HTML page that causes Chrome's built-in PDFium engine to render attacker-controlled PDF content, triggering the use-after-free. No authentication is required (PR:N) and default configurations are affected - PDFium is bundled and enabled by default in Chrome. The key limiting factor is scope: code execution is confined to the renderer sandbox (S:U), so full system compromise additionally requires chaining a separate sandbox-escape vulnerability. Only Chrome builds prior to 153.0.8010.52 are affected; updated browsers are not exploitable.

This is a classic renderer-side memory-corruption bug: CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-reachable, low-complexity, unauthenticated exploitation requiring only that a victim open a crafted HTML/PDF page. The single most important nuance is S:U combined with the description's own wording - 'execute arbitrary code inside the sandbox.' This is NOT a full host compromise; code runs within Chrome's renderer sandbox and needs to be chained with a separate sandbox-escape bug to compromise the underlying OS. That materially lowers real-world impact relative to the raw 8.8. On exploitation signals: no EPSS score, no CISA KEV listing, and no public POC are present in the input, so this is 'no public exploit identified at time of analysis' - not active exploitation. Google's Chromium 'severity: High' rating is consistent with an in-sandbox RCE rather than a Critical (which Chrome reserves for sandbox escapes/RCE outside the sandbox). Net: a genuine and patch-worthy issue given Chrome's ubiquity and drive-by delivery, but on its own a mid-tier priority absent evidence of exploitation or a paired escape. No SSVC decision data was provided.

An attacker hosts a malicious web page embedding a crafted PDF that triggers the use-after-free in PDFium when Chrome renders it, or lures a user to open such a PDF; the victim need only visit the page (UI:R). Successful exploitation yields arbitrary code execution confined to the renderer sandbox, which the attacker would then need to pair with a sandbox-escape vulnerability to reach the host. No public exploit code is identified at time of analysis.