A use‑after‑free flaw in the PDF handling component of Google Chrome allows a remote attacker to execute arbitrary code outside the browser sandbox by loading a crafted HTML page that references a malicious PDF. The vulnerability can lead to full system compromise because the attacker can run code with the privileges of the current user, impacting confidentiality, integrity, and availability.

Google Chrome browsers prior to version 155.0.8059.79 are affected. The flaw resides in the Chromium PDF viewer shipped with Chrome and applies to all operating systems that run this browser build.

The CVSS score is 9.6, indicating a high severity. The EPSS score indicates a very low, but non‑zero, probability of exploitation (<1%). The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted HTML page that the user opens, which triggers the PDF viewer to process malicious content and trigger the use‑after‑free. An attacker can then execute code outside the sandbox with user privileges.