EUVD-2026-93849
GHSA-5334-jvcc-pp32
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted PDF to victim
-
ExploitVictim opens PDF in Chrome
-
ExecutionTrigger use-after-free in PDF component
-
ImpactExecute arbitrary code in sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted PDF file within Google Chrome's built-in PDF viewer on a version prior to 155.0.8059.39 (UI:R confirms required user interaction) - it is not automatic or server-side. A key LIMITING factor is that the resulting arbitrary code execution is confined to the Chrome renderer sandbox per the description, so full host compromise additionally requires chaining a separate sandbox-escape vulnerability. No special non-default configuration is needed since PDF rendering is enabled by default; exploitation is unauthenticated but depends entirely on the user interaction of opening the malicious document. |
| Impact | Multiple signals must be weighed against each other here. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity, unauthenticated code execution, but it requires user interaction (UI:R) - the victim must open a crafted PDF. Critically, the description states the arbitrary code executes INSIDE the Chrome sandbox (scope unchanged, S:U), meaning this alone does not grant host-level compromise without a separate sandbox-escape chain; the CVSS score does not discount for this containment. The signals point toward lower immediate urgency than the 8.8 suggests: CISA SSVC lists Exploitation as 'none' and Automatable as 'no' (though Technical Impact 'total'), there is no CISA KEV listing, and no public exploit was identified in the provided data. EPSS was not supplied. So while technical impact is severe (memory-corruption RCE in a ubiquitous browser), real-world exploitation signals are currently absent/low, making this a patch-on-normal-cadence item rather than an emergency - with the caveat that Chrome memory-corruption bugs are historically attractive targets and are frequently chained. Note the 'Denial Of Service' tag is consistent with CWE-416 use-after-free but the primary documented impact is RCE. |
| Exploit ScenarioDerived | An attacker hosts or emails a specially crafted PDF and lures a victim into opening it in Google Chrome (versions prior to 155.0.8059.39). The malformed PDF triggers a use-after-free in Chrome's PDF component, giving the attacker arbitrary code execution within the renderer sandbox; a further sandbox-escape would be needed for full host compromise. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Use-after-free in Google Chrome's built-in PDF handling (fixed in 155.0.8059.39) lets remote, unauthenticated attackers execute arbitrary code inside the Chrome renderer sandbox when a victim opens a crafted PDF file - exploitation is not automatic and depends entirely on the user interaction of opening the document (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416). Because the code execution is confined to the sandboxed renderer, turning this into full host compromise would require chaining a separate sandbox-escape bug; the advisory rates it Chromium severity High. At the time of analysis there is no public exploit identified and CISA SSVC records exploitation as none, though the vulnerability is fully described and a vendor patch plus the underlying Chromium issue tracker entry are publicly referenced. Google Chrome versions before 155.0.8059.39 are affected on all platforms tracked under cpe:2.3:a:google:chrome.
RemediationAI
Upgrade Google Chrome to 155.0.8059.39 or later - this is the version identified in the Chrome stable channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html) as containing the fix, and patch status is confirmed as available from the vendor; after updating, fully restart the browser so the new build replaces the running renderer processes. Until every user is updated, reduce exposure with the following compensating controls, each with its own trade-off: configure the PDF viewer to download PDF files instead of opening them in-browser (chrome://settings/content/pdfDocuments), which prevents the vulnerable PDF rendering path from being reached but degrades the inline viewing experience; if that is too disruptive, apply an enterprise policy to disable or divert PDF handling and rely on a hardened external reader, accepting the added document-handling risk and support overhead. Blocking PDF delivery at the network or mail gateway reduces the chance a malicious document reaches users, at the cost of blocking legitimate business documents and failing against files delivered through webmail or personal channels. Keep Chrome's sandbox enabled and leave site isolation active - the sandbox is precisely what limits this bug to renderer-level code execution, so it should not be weakened as a mitigation elsewhere. Because the report is credited to Chrome and the release notes do not publicize an exploit, defend by patching on a short cadence rather than relying on signature-based detection; monitor the Chromium issue at https://issues.chromium.org/issues/567910530 and the Chrome release blog for any update to the exploitation status before relaxing urgency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a use-after-free (CWE-416), a memory-safety class in which an object is freed while a stale pointer to it is still dereferenced, allowing an attacker who can control the contents of the freed allocation to influence program control flow. Here the flaw lives in Chrome's PDF rendering path, meaning malformed PDF content - parsed and laid out by the browser's built-in viewer - drives the dangling reference. Successful corruption yields arbitrary code execution with the privileges of the PDF/renderer process, which under Chrome's multi-process sandbox architecture is deliberately low-privilege; the attacker gains code execution "inside the sandbox" as stated in the advisory, not host-level access. The CVSS vector confirms network-reachable exploitation with no privileges (PR:N) but a real user-interaction requirement (UI:R), and high confidentiality, integrity, and availability impact (C:H/I:H/A:H) on the compromised renderer. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* is a vendor-level wildcard rather than a version-constrained designation, so the authoritative boundary is the version stated in the Chrome release advisory: every build prior to 155.0.8059.39. Associated tags (RCE, memory corruption, use after free, denial of service) align with a memory-corruption primitive that can also crash the renderer. ENISA's EUVD entry (EUVD-2026-93849) tracks the same affected range, and CISA SSVC classifies technical impact as total while noting exploitation none and automatable no, consistent with the required user interaction.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
PDF is delivered remotely and opened by the user (AV:N, UI:R), needs no privileges (PR:N), and yields high-impact code execution confined to the sandbox (S:U).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 155.0.8059.39 contain a high-severity memory-safety flaw in the browser's built-in PDF viewer that could allow an attacker to run malicious code on an employee's workstation if they open a specially crafted PDF. Because Chrome is deployed broadly across the organization, a large portion of the workforce is potentially exposed, and a successful attack could lead to data theft or further lateral movement depending on the endpoint's configuration. A vendor patch is already available, so remediation is a matter of deployment speed rather than mitigation design, and the absence of public exploit code means the near-term risk is manageable if patching is completed promptly.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB