A buffer overflow flaw in the PDFium component of Google Chrome before version 155.0.8059.79 allows a remote attacker to execute arbitrary code inside the browser’s sandbox when a user opens a crafted HTML page that includes a malicious PDF object. The vulnerability is a classic memory corruption (CWE‑122). Exploitation would give the attacker code‑execution privileges constrained to the sandbox, which could be used to compromise the user’s session or potentially facilitate additional attacks.

All installations of Google Chrome prior to 155.0.8059.79 are affected, regardless of operating system. Anyone who can view an HTML page containing a crafted PDF object is at risk.

The CVSS score of 8.8 classifies it as high severity, but the EPSS score of less than 1 % indicates that, at the time of assessment, the likelihood of active exploitation was low. The issue is not listed in CISA’s KEV catalogue. Attackers can trigger the flaw remotely by persuading users to load a malicious page; no local privilege escalation is required, and the vulnerability can be triggered on any device running the vulnerable browser builds.