CVE-2026-11303

chromium-browser: Use after free in PDFium

View on CVE.org
Published Jun 4, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

Analysis

AI-generated

Technical impact

A use‑after‑free flaw in PDFium can be triggered with a crafted PDF file, allowing a remote attacker to execute arbitrary code inside Chrome’s sandbox. The vulnerability is a classic use‑after‑free (CWE‑416) and also includes a file‑access control issue (CWE‑825) within the sandbox that could allow further compromise.

Affected Systems

Google Chrome users on any desktop platform running a version earlier than 149.0.7827.53 are affected.

Risk and Exploitability

Chromium severity is listed as Low, but its CVSS score of 8.8 indicates a high potential for remote code execution. The EPSS score of < 1% suggests a very low probability that this vulnerability is actively exploited. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a user to open a malicious PDF in Chrome. The likely attack vector is inferred to be a user opening a malicious PDF via social engineering or a drive‑by download. While the flaw is theoretically exploitable, its impact is confined to the sandboxed process and the lack of a widely known exploit reduces immediate risk, yet patching remains strongly recommended.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 149.0.7827.53 or later
  • Enable Chrome auto‑update to receive the fix automatically
  • Avoid opening PDF files from untrusted or unknown sources until the browser is updated
  • Verify that Chrome’s sandbox enforces strict file‑access permissions to mitigate the CWE‑825 file‑access control weakness

Generated by OpenCVE AI on June 7, 2026 at 16:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History
Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
Type Values Removed Values Added
Title chromium-browser: Use after free in PDFium
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Low
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Remote Code Execution via PDFium Use‑After‑Free
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Remote Code Execution via PDFium Use‑After‑Free
Type Values Removed Values Added
Description Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)
Weaknesses CWE-416
References
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Jun 6, 2026, 3:56 AM
Reserved
Jun 4, 2026, 5:11 PM

View source JSON

Updated
Jun 5, 2026, 1:00 AM

JSON

Status
Analyzed
Published
Jun 5, 2026, 12:17 AM
Modified
Jul 23, 2026, 7:10 AM

View source JSON

Severity
Low
Public date
Jun 2, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Jun 7, 2026, 4:30 PM

JSON