A use‑after‑free flaw in PDFium can be triggered with a crafted PDF file, allowing a remote attacker to execute arbitrary code inside Chrome’s sandbox. The vulnerability is a classic use‑after‑free (CWE‑416) that may be exploited by a remote attacker.

Google Chrome users on any desktop platform running a version earlier than 149.0.7827.53 are affected.

The CVE lists Chromium severity as Low, and no EPSS score is available; the vulnerability is not currently in CISA’s KEV catalog. Exploitation requires a user to open a malicious PDF in Chrome. The likely attack vector is inferred to be a user opening a malicious PDF via social engineering or a drive‑by download. While the flaw is theoretically exploitable, its impact is confined to the sandboxed process and the lack of a widely known exploit reduces immediate risk, yet patching remains strongly recommended.