Executive brief
Google Chrome's PDFium component, which is responsible for rendering PDF documents within the browser, contains a security vulnerability. An attacker could exploit this by tricking a user into opening a specially crafted PDF file, potentially leading to memory corruption. While rated as low severity, such issues can sometimes be used as part of a larger chain to disrupt the browser's stability or access sensitive information.
Technical details
A use-after-free (UAF) vulnerability exists in PDFium, the PDF rendering engine used in Google Chrome. The flaw is triggered when the engine incorrectly manages memory lifecycle during the processing of a specially crafted PDF document. A remote attacker can exploit this by hosting a malicious PDF file and inducing a user to view it, leading to heap corruption. This could potentially result in a browser crash or, in more complex scenarios, limited arbitrary code execution within the sandbox. The issue was addressed in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome version 149.0.7827.53 released to stable channel.
- 2026-06-05: disclosed: CVE published to NVD.