Use after free in PDFium permits a remote attacker to trigger heap corruption through a specially crafted PDF file presented to Google Chrome. The flaw may allow arbitrary code execution or denial of service by corrupting memory structures during PDF processing. The vulnerability is a memory‑management weakness classified as CWE‑416 and is rated as high severity by Chromium security.

Google Chrome versions prior to 148.0.7778.216 are affected. Users who have not updated Chrome to at least 148.0.7778.216 or a later release are vulnerable. The issue is confined to the built‑in PDF viewer component within Chrome.

Exploitation requires the victim to open a malicious PDF file, which is a typical remote–vector scenario. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet. However, the CVSS score of 8.8, which is considered high, and the potential for arbitrary code execution mean that the risk is significant for exposed systems. The most efficient attack path is to deliver a malicious PDF via email or web download and entice the user to view it in Chrome.